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THE CHEMICAL FACILITY ANTI-TERRORISM 
STANDARDS PROGRAM: A PROGRESS REPORT 


TUESDAY, SEPTEMBER 11, 2012 

House of Representatives, 

Subcommittee on Environment and the Economy, 

Committee on Energy and Commerce, 

Washington, DC. 

The subcommittee met, pursuant to call, at 10:00 a.m., in room 
2322, Rayburn House Office Building, Hon. John Shimkus (chair- 
man of the subcommittee) presiding. 

Members present: Representatives Shimkus, Murphy, Latta, 
Cassidy, Gardner, Barton, Upton (ex officio). Green, Butterfield, 
and Barrow. 

Also present: Representative Pompeo. 

Staff present: Nick Abraham, Legislative Clerk; Charlotte Baker, 
Press Secretary; Sean Bonyun, Communications Director; Matt 
Bravo, Professional Staff Member; Jerry Couri, Senior Environ- 
mental Policy Advisor; David McCarthy, Chief Counsel, Environ- 
ment and the Economy; Andrew Powaleny, Deputy Press Secretary; 
Chris Sarley, Policy Coordinator, Environment and the Economy; 
Brett Scott, Staff Assistant; Jacqueline Cohen, Democratic Counsel; 
Greg Dotson, Democratic Staff Director, Environment and the 
Economy; Elizabeth Letter, Democratic Assistant Press Secretary; 
Karen Lightfoot, Democratic Communications Director and Senior 
Policy Advisor; and Stephen Salsbury, Democratic Staff Assistant. 

Mr. Shimkus. The subcommittee will come to order. And we 
would ask our guests to come on in and sit down and close the 
doors, and we will welcome our first panel. 

I have an opening statement which I will read in part and hope- 
fully then get unanimous consent to submit for the record. 

OPENING STATEMENT OF HON. JOHN SHIMKUS, A REP- 
RESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS 

I have been thinking about CFATS for a long time, since the last 
hearing, and how long it has taken and the past problems, et 
cetera, et cetera, et cetera. We all know the story. 

You know, the Illinois State flag has a banner underneath it that 
says “State sovereignty, national unity.” And I think part of our de- 
bate is, here at the national level, are States still sovereign? And 
how do we address national unity issues like homeland security 
and the like? And I think this is a perfect program that, if done 
properly, we can move in a good direction. 

What do we need on security? As many of you know, I have a 
military background. I served in West Germany during the old 
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days. I understand security, I understand perimeters, I understand 
threats, not as well as those who are involved more deeply today. 

But we want folks to have perimeter security. We would like the 
national government to provide assistance in identifying insecure 
facilities or placement of chemicals and operations and stuff. As I 
said, assistance, not the threats, not the mandates. 

And then we do need to address the personal assurance issues 
about who is involved in working around what type of materials. 

I think that really encompasses my view of CFATS. How can we 
work together so that we are all better off? I think we still have 
a ways to go. I know we are making progress since the last hear- 
ing, but I think there are still issues to address. 

And I know that there are some issues about why today, and was 
this planned, and was there politics behind today. At least that is 
what the rumors were from staff. And, first of all, no, this is the 
last full week here. We have to get through this. 

But the second point I would say, how do you best honor those 
on a day like today than to address the threats of today? I think 
we do more, if we are really concerned about the threats posed, to 
continue to address our issues of safety and security on today. I 
think that is how you better honor folks, by moving forward. 

So whatever debates and statements on that are, I don’t really 
have a dog in that fight, and I could really care less what people 
think on that. 

After the last hearing on this issue, I know testimony is going 
to be that we have implemented — or DHS has implemented 59 of 
its 95 corrective actions. We will want to ask, where we are at on 
the other 36? 

I will address questions on the permanent branch chiefs. I do 
think having people in positions for a period of time is probably an 
important thing for continuity and for process. I have a national 
forest in my congressional district. My relationships with the man- 
ager and the forest and all the stakeholders are much better when 
the same person is there over a couple years versus swapping them 
out every 6 months or every year. And I think that is true probably 
at any Federal agency. My staffers who deal with constituent serv- 
ice are much better having continued to do that work over years 
versus having them doing different things. 

We need to also address how do we move forward in a more 
transparent and open system and process. I think that is an issue, 
also, of the last hearing. 

So I look forward to the hearing. I think it is very, very impor- 
tant. 

Just for my colleagues who have shown up, Mr. Beers has agreed 
to waive his opening statement so that we can move questions after 
we get through ours because of the time constraints with the cere- 
mony and your early departure. And we appreciate that. 

So, with that, I am going to yield back the balance of my time 
and yield to the ranking member, Mr. Green, for 5 minutes. 

[The prepared statement of Mr. Shimkus follows:] 



Opening Statement Chairman John Shimkus 
The CFATS Program - A Progress Report 
September 11. 2012 


The Subcommittee will now come to order. We have a very full 
hearing today and the House and the Committee have an ambitious 
schedule. We appreciate everyone’s indulgence as we try to navigate 
all the considerations we face today. 

The Chair now recognizes himself for the purpose of delivering 
an opening statement. 

Many folks have commented about our hearing being scheduled 
for 9-11 - the 11th anniversary of the horrific attacks against our 
nation. Although today's hearing falling on the anniversary is a 
coincidence, the attacks were the driving force behind the creation of 
the Chemical Facility Anti-Terrorism Standards program, and we 
remain steadfast in our work to protect the American people from 
future attacks. I can guarantee that we will continue closely following 
the progress the Department of Homeland Security is making in fully 
implementing the CFATS program. 
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What I can guarantee everyone is it is no accident we are having 
another hearing on the progress the Department of Homeland 
Security is making in fully implementing the Chemical Facility Anti- 
Terrorism Standards program (CFATS). 

This past February, the Subcommittee held a hearing which 
discussed enormous challenges confronting the CFATS program’s 
execution. Sadly, this was a story contradicting most every ounce of 
previous testimony Congress had been provided by DHS and the 
regulated community about the soundness of DHS’ s implementation 
efforts. While 1 am glad the two brave employees penned the internal 
memo outlining the true state of play for CFATS, Congress shares 
some culpability in having allowed it to get this bad without greater 
oversight. 

I support the CFATS statute and 1 think the regulations 
implementing the law are reasonable. 1 want it to succeed because I 
think it presents the best solution for dealing with terrorism at 
facilities with chemicals of interest. However, I do not support 
waste, fraud, and abuse - and it seemed we had a bipartisan 
consensus on this point at the last CFATS hearing. 


2 
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Seven months after our panel first heard sworn testimony from 
Under Secretary Beers about the state of CFATS and its plan forward 
today is our checkup on how things are going at DHS. 

For all the support Congress has given over the years, CFATS 
should have more to show than repelling ropes, hazmat suits, and 
delayed implementation. 

1 understand DHS intends to tell us it has completed or 
implemented 59 or its 95 corrective “action” items. While I 
congratulate them for making progress, 1 want to know about how we 
are moving forward on the 36 remaining items, including the use of 
alternate security programs and the personnel surety program. 

I also believe DHS is working on an alignment plan and finally 
making efforts to hire permanent branch chiefs. What I want to hear 
is whether DHS leadership has scoped out the job descriptions for 
these managers or if DHS intends to have their employees write the 
boss’s job description. In addition, I want to know what DHS is 
doing to assure management continuity and reverse the constant 
turnover of CFATS leadership career employees. 
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Finally, Under Secretary Beers made several attempts in our 
February hearing to describe how he intends to create a more open, 
transparent and collaborative National Protection and Programs 
Directorate and thaw the chill from fear of retaliation employees felt 
if they delivered bad news. I want to know how that is going as well 
as examine concrete examples of his efforts. 

I want to sincerely welcome all of our witnesses, we appreciate 
your being here and the perspective you provide. I will warn you: 
We are going to ask tough questions, and not for any reason other 
than because we are serious about protecting the American people 
from terrorism in the most appropriate way. We expect candor and 
the whole truth in response to our inquiries. 

I now yield 5 minutes to my friend, the Ranking Member and 
distinguished gentleman from Houston, Texas, Mr. Green, for the 
purposes of delivering an opening statement. 


4 
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OPENING STATEMENT OF HON. GENE GREEN, A 
REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. Green. Thank you, Mr. Chairman, for holding this hearing 
today. And I don’t know if it is special timing, hut I think the rea- 
son we have chemical security is because of 9/11 and the concern 
we have about our major industrial facilities. 

I want to welcome both of our panels. 

This important issue — I am glad to see our subcommittee con- 
tinue oversight of this critical program. I represent the Houston 
Ship Channel area, which is the largest petrochemical complex in 
the country. I cannot stress how important the success of the 
CFATS program is to my constituents who are the employees and 
live in the communities that surround the facilities. They deserve 
the best security standards possible to prevent acts of terrorism on 
U.S. Soil. 

Secretary Beers, you did not testify under the best circumstances 
last February, but I hear that you have some positive things to re- 
port this time around. And I appreciate that things are starting to 
move, but we cannot ignore that it has been 6 years since this pro- 
gram was enacted and we are still not close to being there yet. It 
is time to get these plants inspected and approved, and I hope that 
you have a deadline for doing so to report to us this morning. 

That said, it is Congress’ job to make sure you have the re- 
sources to do this. I understand that the House appropriators sig- 
nificantly cut your budget. With movement finally happening in the 
last few months, now is not the time to limit resources. And I en- 
courage my colleagues not to set us back now. 

I want to end by talking about a subject that is of prime impor- 
tance to me, and that is personnel surety. Developing and imple- 
menting a personnel surety program that relies on existing govern- 
ment credential systems, like the TWIC, would reduce a burden on 
DHS and the workers at these facilities and the industry. 

Secretary Beers, last year I asked if the Department intended to 
integrate TWIC in the personnel security program. You gave me a 
positive response, and yet the proposal you sent to the 0MB did 
not make it clear that TWIC is an acceptable background check. I 
am pleased that you rescinded the proposal in July, but understand 
that you will resubmit a revised personnel security program in the 
coming months. I hope today that you will definitely commit to al- 
lowing the Transport Worker Identification Card, or TWIC, to be 
used without caveats for workers or industries. 

We will soon be reissuing thousands and thousands of TWIC 
cards because they are expiring, including mine expires in June of 
next year. I have spent so much time on plant sites in my district. 
At the Port of Houston, we have over 250,000 employees who use 
a TWIC card every day to get to work — 250,000. Multiply that 
across the country. There is no reason to reinvent the wheel. We 
need to fix TWIC and use it as the standard card. 

I regret Congress has still not passed a CFATS authorization. I 
still believe that a lot of problems with the CFATS program stems 
directly from not having a permanent authorization with direction 
from Congress. Chemical facilities security is extremely important 
to the protection of public health and safety throughout the U.S., 



8 


particularly in our congressional district. There is no reason we 
should not act on this issue. 

And I look forward to the testimony of our witnesses. And thank 
you, Mr. Chairman. I yield back my time. 

Mr. Shimkus. The gentleman yields back his time. 

The chair recognizes the chairman of the full committee, Mr. 
Upton, for 5 minutes. 

OPENING STATEMENT OF HON. FRED UPTON, A REPRESENTA- 
TIVE IN CONGRESS FROM THE STATE OF MICHIGAN 

Mr. Upton. Well, thank you, Mr. Chairman. I am going to ask 
that my full statement be made part of the record. 

Mr. Shimkus. Without objection. 

Mr. Upton. I just want to say, 6 months ago we authorized 
CFATS. We were very conscious that the next terrorism incursion 
could come from within a chemical plant instead of on board an air- 
plane. 

And those of us who were here in DC. 11 years ago remember 
well every single minute of that day. And I, for one, made a prom- 
ise that we should do everything that we can to make sure that 
that moment doesn’t occur again in this Nation. We have to honor 
the victims and their loved ones by working together to ensure that 
such an attack can never happen again. And I support Chairman 
Shimkus and all that he is doing to make sure that, in fact, we are 
better safeguarded as a nation. 

And I yield back my time. 

[The prepared statement of Mr. Upton follows:] 
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Environment and the Economy Subcommittee Hearing on The Chemical 
Facilities Anti-Terrorism Standards Program - A Progress Report 
September 11, 2012 

Opening Statement of Chairman Fred Upton 

Thank you, Mr. Chairman. In a few minutes this hearing will recess so that 
Members of both parties and both bodies of Congress can gather at the Capitol for 
a solemn observance of today’s anniversary. 

For eleven years now, we in this room, Members of Congress and Executive 
Branch officials, have been called to exhibit the courage and teamwork to protect 
America from terrorism. We have reassessed our daily lives and the systems we 
rely on to limit vulnerability without limiting the American way of life. 

Six years ago this month we authorized the CFATS program, conscious that 
the next terrorist incursion could come from within a chemical plant instead of 
onboard an airplane. It is one of many facets of our complex economy that we 
look at differently in the shadow of 9/1 1, even as we recognize its important role in 
our nation’s system of commerce. 

Today we’re examining key questions on the progress of this program; 

• Where are we on preventing personal infiltration of chemical plants? 

• Of the thousands of facilities that DHS says need CFATS, how many can 
confirm for their workers, their neighbors, their investors, and their insurers 
that they have achieved security against terrorism as defined by the U.S. 
Department of Homeland Security? 
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• Does the culture of the Department reinforce candor and teamwork in 
exchanging perspectives with each other, with stakeholders, and with the 
American people and their Representatives in Congress? 

When we play team sports we know that “hide the ball” means hiding it 
from the opposition, not from members of our own team. Secretary Beers, this 
Committee is not your opponent; the terrorists are our common opponent. We are 
your teammates. 

The horrific attacks against our nation that fateful morning eleven years ago 
continue driving all of our vigilance to protect the homeland. We must honor all of 
the victims and their loved ones by working together to ensure such an attack never 
happens again. 

Mr. Chairman, I welcome all of our witnesses and look forward to their 
candid testimony and complete answers. 
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Mr. Shimkus. The gentleman yields back his time. 

With that, seeing no other Members here authorized for an open- 
ing statement, the chair now recognizes himself. 

First of all, as stated earlier, both Mr. Beers and Ms. Berrick, 
both have agreed to waive their opening statements so we can go 
right to questions. We appreciate that. 

[The prepared statement of Mr. Beers and Mr. Wulf and the pre- 
pared statement of Ms. Berrick follow:] 
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Statement for the Record 


Undersecretary Rand Beers 
National Protection and Programs Directorate 
Department of Homeland Security 


Director David Wulf 

National Protection and Programs Directorate 
Department of Homeland Security 

Before the 

House Committee on Energy and Commerce 
Subcommittee on Environment and the Economy 
United States House of Representatives 

September 1 1, 2012 

Thank you, Chairman Shimkus, Ranking Member Green, and distinguished Members of the 
Committee. It is a pleasure to appear before you today to discuss the Department of Homeland 
Security’s (DHS) regulation of high-risk chemical facilities under the Chemical Facility Anti- 
Terrorism Standards (CFATS). My testimony today focuses on improvements to the program, 
the current status of the program, examples of the program’s successes to date, some of the 
current challenges facing the National Protection and Programs Directorate (NPPD) in 
implementing CFATS, and the actions we are taking to address these challenges through the 
Infrastructure Security Compliance Division (ISCD) Action Plan. 

The CFATS program has made our Nation more secure and we welcome the opportunity to 
continue to work with Congress, all levels of government, and the private sector to further 
improve this vital national security program. As you are aware, the Department’s current 
statutory authority to implement CFATS - Section 550 of the Fiscal Year (FY) 2007 Department 
of Homeland Security Appropriations Act, as amended -currently extends through October 4, 
2012 . 

Since the inception of CFATS, more than 2,700 chemical facilities have eliminated, reduced, or 
otherwise made modifications to their holdings of potentially dangerous chemicals and are now 
no longer considered high-risk. In addition, NPPD’s Chemical Security Inspectors have been 
actively working with facilities and governmental agencies across the country to facilitate the 
development of measures by high-risk chemical facilities that reduce security risks and enhance 
nationwide preparedness. Collectively, they have participated in more than 3,800 meetings with 
federal, state, and local officials; held more than 4,160 introductory meetings with owners and 
operators of CFATS-regulated or potentially regulated facilities; and conducted more than 1,050 
Compliance Assistance Visits at chemical facilities to assist those facilities in the preparation of 
the necessary security-related documentation required by CFATS. In addition, NPPD has 
reviewed the Site Security Plans (SSPs) of the highest risk (Tier 1) facilities and is currently 
reviewing the SSPs for Tier 2 facilities. We have resumed authorization inspections [and begun 
approving SSPs for Tier 1 facilities]. 
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At my direction, the program’s leadership outlined its priorities, the challenges it believes the 
program faces, and a proposed path forward to address those challenges and accomplish program 
objectives. As the Directorate with oversight responsibility for the CFATS program, NPPD is 
continually evaluating the program to identify areas for improvement and correcting course when 
necessary to ensure proper implementation. I am pleased to inform you that NPPD has made 
progress on all 95 of the action items now included in the ISCD Action Plan and as of September 
4, 2012 has completed 59 of them. 

Chemical Facility Security Regulations 

Section 550 of the FY 2007 Department of Homeland Security Appropriations Act directed the 
Department to develop and adopt within six months a regulatory framework to address the 
security of chemical facilities that the Department determines pose high levels of risk. 
Specifically, Section 550(a) of the Act authorized the Department to adopt regulatory 
requirements for high-risk chemical facilities to complete Security Vulnerability Assessments 
(SVAs), develop SSPs, and implement protective measures necessary to meet risk-based 
performance standards established by the Department. Consequently, the Department published 
final regulations, known as CFATS, on April 9, 2007. Section 550, however, expressly exempts 
from the regulation certain facilities that are regulated under other federal statutes, specifically 
those regulated by the United States Coast Guard (USCG) pursuant to the Maritime 
Transportation Security Act, drinking water and wastewater treatment facilities as defined by 
Section 140! of the Safe Water Drinking Act and Section 212 of the Federal Water Pollution 
Control Act, and facilities owned or operated by the Department of Defense or Department of 
Energy, as well as certain facilities subject to regulation by the Nuclear Regulatory Commission 
(NRC). 

The following core principles guided the development of the CFATS regulatory structure: 

1 . Securing high-risk chemical facilities is a comprehensive undertaking that involves a 
national effort, including all levels of government and the private sector. Integrated and 
effective participation by all stakeholders — ^Federal, state, local, and territorial 
government partners as well as the private sector — is essential to securing our critical 
infrastructure, including high-risk chemical facilities; 

2. Risk-based tiering is used to guide resource allocations. Not all facilities present the 
same level of risk. The greatest level of scrutiny should be focused on those facilities 
that present the highest risk — those that, if targeted, would endanger the greatest number 
of lives; 

3. Reasonable, clear, and calibrated performance standards will lead to enhanced security. 
The CFATS rule establishes enforceable risk-based performance standards (RBPS) for 
the security of our nation’s high-risk chemical facilities. High-risk facilities have the 
flexibility to develop appropriate site-specific security measures that will effectively 
address risk by meeting these standards. ISCD will analyze all final high-risk facility 
SSPs to ensure they meet the applicable RBPS and will approve those that do. If 
necessary, ISCD will work with a facility to revise and resubmit an acceptable plan and 
can disapprove security plans if an acceptable plan is not submitted; and 
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4. Recognition of the progress many companies have already made in improving facility 
security leverages those advancements. Many companies made significant capital 
investments in security following 9/1 1, and even more have done so since the passage of 
the legislation establishing this program. 

Rule Implementation 

Within a few months after the final regulations were developed, on November 20, 2007, the 
Department published CFATS Appendix A, which identifies 322 chemicals of interest — 
including common industrial chemicals such as chlorine, propane, and anhydrous ammonia — as 
well as specialty chemicals, such as arsine and phosphorus trichloride. These chemicals were 
included after analyzing the potential consequences associated with one or more of the following 
three security issues: 

1 . Release - Toxic, flammable, or explosive chemicals that have the potential to create 
significant adverse consequences for human life or health if intentionally released or 
detonated; 

2. Theft/Diversion - Chemicals that have the potential, if stolen or diverted, to be used as or 
converted into weapons that could cause significant adverse consequences for human life 
or health; and 

3. Sabotage/Contamination - Chemicals that are shipped and that, if mixed with other 
readily available materials, have the potential to create significant adverse consequences 
for human life or health. 

NPPD also established a Screening Threshold Quantity for each chemical of interest based on its 
potential to create significant adverse consequences to human life or health in one or more of 
these ways. Any chemical facility that possesses any chemical of interest at, or above the 
applicable Screening Threshold Quantity must submit an initial consequence-based screening 
tool, the “Top-Screen,” to NPPD. 

This Top-Screen process developed by NPPD allows the government, for the first time, to gather 
data that can identify potential high-risk facilities, which NPPD then assigns to one of four 
preliminary risk-based tiers, with Tier 1 representing the highest level of potential risk. 

To support this activity, ISCD developed the Chemical Security Assessment Tool (CSAT) to 
help NPPD identify potentially high-risk facilities and to provide methodologies those facilities 
can use to conduct SVAs and to develop security plans. CSAT is a suite of online applications 
designed to facilitate compliance with the program; it includes user registration, the Top-Screen, 
an SVA tool, and an SSP template. To protect this sensitive information, NPPD developed an 
information management regime. Chemical-terrorism Vulnerability Information (CVI), which 
limits access to trained and authorized users. 


In May 2009, NPPD issued Risk-Based Performance Standards Guidance to assist final high- 
risk chemical facilities in determining appropriate protective measures and practices to satisfy 
the KBPS. It is designed to help facilities comply with CFATS by providing detailed 
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descriptions of the 18 RBPS as well as examples of various security measures and practices that 
could enable facilities to achieve the appropriate level of performance for the RBPS at each tier 
level. The Guidance was informed by the experience of the Transportation Security 
Administration, United States Coast Guard, and the Environmental Protection Agency, and also 
reflects public and private sector dialogue on the RBPS and industrial security, including public 
comments on the draft guidance document. High-risk facilities are free to make use of 
whichever security programs or processes they choose — ^whether or not in the Guidance — 
provided that NPPD determines through approval of the facilities’ SSPs that they achieve the 
requisite level of performance under the CFATS RBPS. 

Implementation Status 

To date, ISCD has data from more than 41,000 Top-Screens submitted by chemical facilities, 
providing important information about their chemical holdings. Since June 2008, ISCD 
identified more than 8,000 facilities that it has initially designated as high-risk. These facilities 
have used the CSAT tool to compile and submit SVAs. In May 2009, following reviews of 
facilities’ SVA submissions, ISCD began notifying facilities of their final high-risk 
determinations, risk-based tiering assignments, and the requirement to complete and submit an 
SSP or an Alternative Security Program (ASP) in lieu of an SSP. 

As of September 4, 2012, CFATS covers 4,433 high-risk facilities nationwide; of these 4,433 
facilities, 3,660 are currently subject to final high-risk determinations and have developed 
security plans for NPPD review. The remaining facilities are awaiting final tier determinations 
based on their SVA submissions. ISCD continues to issue final tier notifications to facilities 
across all four risk tiers.' 

Highlights and Successes of CFATS Program 

As we have previously discussed with this Subcommittee, the ISCD Action Plan currently 
contains 95 items, each of which has been assigned to a member of ISCD’s senior leadership 
team for implementation. For accountability, planning, and tracking purposes, the members of 
that leadership team have established milestones and projected timeframes for the completion of 
each task assigned to them. In addition, ISCD leadership meets with the Deputy Under Secretary 
of NPPD at least once per week to provide status updates on the action items and discuss ways 
that NPPD leadership can help. As of September 4, 20 1 2, 59 of the 95 action items contained in 
the Action Plan have been completed. 

I would like to share with the Subcommittee some of the highlights and successes that are a 
direct result of the implementation of the Action Plan and other recent initiatives performed by 
ISCD. These include; improving the SSP review process and increasing the pace of SSP 
reviews; refining inspector tools and training; reinvigorating industry engagement on their 


^ Tiering determinations are dynamic; for example, a tiering determination can change w-hen a facility voluntarily alters its operations in a 
material way that reduces its risk profile, “Final tiering” refers to a tiering assignm«it following a Security Vulnerability Assessment; it does not 
imply that this is the final tiering assignment a facility may receive. 
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development of ASP templates; improving internal communications and organizational culture; 
and preparing for an external peer review of the CFATS risk assessment methodology. 

SSP Review Process. ISCD is currently utilizing a refined approach for reviewing SSPs in order 
to move forward in a more efficient and timely fashion. At this time, ISCD has completed its 
review of all Tier 1 SSPs and has begun reviewing Tier 2 SSPs. As of September 9, 2012, of the 
Tier 1 SSPs reviewed, we have authorized or conditionally authorized SSPs for 73 facilities and 
approved 1 . Of the remaining Tier 1 SSPs reviewed by NPPD, we are either validating results or 
reaching out to these facilities to obtain additional information or action in the hope of resolving 
the outstanding issues affecting their SSPs. Going forward, ISCD will continue to work to 
improve its SSP review process to make it as efficient and effective as possible. 

Inspections. Last Fall, ISCD established an Inspector Tools Working Group to ensure the 
Chemical Security Inspectors have up-to-date and, where appropriate, improved inspections 
procedures, policies, equipment, and guidance. In late spring 2012, ISCD finished updating and 
revising its internal inspections policy and guidance materials for conducting inspections. Over 
the course of the summer, ISCD conducted five inspector training sessions, which focused on the 
updated policy, procedures and related materials to prepare Chemical Security Inspectors to 
resume authorization inspections at facilities with authorized or conditionally authorized SSPs. 
As of July 16, 2012, ISCD has resumed authorization inspections at Tier 1 facilities. This is a 
vital step for moving the CFATS program toward a regular cycle of approving SSPs and 
conducting compliance inspections for facilities with approved SSPs. 

Alternative Security Programs (ASPs). Many members of the regulated community and their 
representative industry associations have expressed interest in exploring ways to use the ASP 
provisions of the CFATS regulation to streamline the security plan submission and review 
process. In support of this, ISCD has been holding vigorous discussions with industry 
stakeholders in regard to their development and submission of ASPs. One particularly promising 
effort has been ISCD’s engagement with the American Chemistry Council (ACC) in support of 
its efforts to develop an ASP template for use by interested members of its organization. The 
ACC has developed a template that was piloted at a facility in early August and is expected to be 
available for use by ACC members later this year. In addition, DHS has been in discussion with 
other industry stakeholders, including the Agricultural Retailers Association, about developing 
templates specific to their members. ASPs submitted by facilities using a template will be 
reviewed under the same standards that ISCD currently reviews SSPs. Additionally, DHS 
continues to review existing industry programs, such as ACC Responsible Care® and SOCMA 
ChemStewards®, to identify potential areas of engagement and further discussion. 

Internal Communications and Employee Morale. The Action Plan contains a number of items 
designed to improve internal communications and morale within ISCD. ISCD has implemented 
many of these action items and has made significant progress on many others. For instance, 
ISCD employees now contribute to and receive a monthly ISCD newsletter, which covers a wide 
variety of both field and headquarters activities. ISCD leadership has promoted staff 
engagement and a dialogue about issues and concerns through monthly town halls and a senior 
leadership open-door policy. ISCD staff has a standing invitation to participate in group open- 
door sessions or to schedule one-on-one discussions with Division leadership. 
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ISCD is also moving forward with issuing vacancy announcements to hire a permanent 
leadership team; several announcements have already been posted and several others are nearing 
posting. Supervisors have been provided with additional supervisory training and guidance on 
performance monitoring. The Division has developed a mission statement, vision statement, and 
core values. As a result of these and other efforts, I believe that Division-wide morale is 
improving, which ultimately will pay dividends not only in improved staff retention, but also in 
improved staff performance and program execution. 

Risk Assessment Methodology Review. In light of prior revisions to the SVA risk assessment 
computer program for chemical facilities, NPPD has committed to doing a thorough review of 
the risk assessment process and keeping the Subcommittee apprised of any significant issues 
related to that review. In support of this, NPPD developed a three-phased approach, which is 
captured in the ISCD Action Plan and includes: documenting all processes and procedures 
relating to the risk assessment methodology; conducting an internal NPPD review of the risk 
assessment process; and initiating an external peer review of the risk assessment methodology. 
The Division has made significant progress on this action item by completing the first two steps. 
ISCD is also approaching completion of procurement actions for the external peer review, which 
is expected to begin before the end of FY 2012. 

NPPD remains committed to both developing appropriate responses to any risk assessment issues 
that it identifies and keeping Congress and stakeholders apprised of any significant issues related 
to that review. 

Personnel Surety. Under CFATS Risk-Based Performance Standard 12 (RBPS 12), final high- 
risk chemical facilities are required to perform background checks on certain individuals with 
access to restricted areas or critical assets. NPPD has been seeking to implement a CFATS 
Personnel Surety Program to enable facilities to comply with the requirement to identify 
individuals who may pose a risk to chemical security by enabling facilities to submit 
biographical information to NPPD. NPPD would compare this biographical information against 
information about known or suspected terrorists listed in the Terrorist Screening Database 
(TSDB). 

Although NPPD has the authority under CFATS to implement the Personnel Surety Program, 
under the Paperwork Reduction Act (PRA) the Office of Management and Budget (0MB) must 
still approve how the NPPD proposes to collect the necessary information to conduct vetting 
against the TSDB. In June of 2009, DFIS began the process to obtain 0MB approval by 
publishing in the Federal Register a notice soliciting public comments for 60 days. 

Following the public comment, DBS submitted the Information Collection Request (ICR) to 
0MB in June of 2011. Since that time, the Department’s position on how facilities can comply 
with RBPS 12 has evolved, thanks in large part to information the chemical industry has 
provided to us as part of the PRA process. As a result, in July of 2012, the Department withdrew 
the ICR from 0MB review. This has enabled the Department to engage in direct dialogue with 
security partners and with stakeholders in the regulated community about the CFATS Personnel 
Surety Program. Additionally, the Department has learned a great deal about various facilities 
through visits to chemical facilities it has conducted. This on-the-ground knowledge of the 
facilities will help to inform the Department of any impacts that the Personnel Surety Program 
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will may have. The Department plans to re-initiate the PRA process by publishing a 60-day 
notice to solicit comment in the Federal Register in the near future. After that, the Department 
will concurrently publish a 30-day notice to solicit additional comments, and submit a new ICR 
for the CFATS Personnel Surety Program to 0MB for review. 

Outreach Efforts 

Since the establishment of CFATS in April 2007, NPPD and ISCD have taken significant steps 
to publicize the rule and ensure that the regulated community and other interested or affected 
entities are aware of and meeting its requirements. NPPD and ISCD management and staff have 
presented at hundreds of security and chemical industry conferences and participated in a variety 
of other meetings. As part of this outreach program, NPPD and ISCD have regularly updated 
impacted sectors through their Sector Coordinating Councils and the Government Coordinating 
Councils — including the Chemical, Oil and Natural Gas, and Food and Agriculture Sectors. 

NPPD and ISCD continue to collaborate within DHS and with other federal agencies in the area 
of chemical security, including routine engagement with; the USCG; the Transportation Security 
Administration; the Department of Justice’s Federal Bureau of Investigation and Bureau of 
Alcohol, Tobacco, Firearms and Explosives; the NRC; and the Environmental Protection 
Agency. In addition, ISCD continues to focus on fostering solid working relationships with state 
and local officials including first responders. 

To promote information sharing, ISCD has developed several communication tools for 
stakeholder use, including: the Chemical Security website twww.DHS.gov/chemicalsecuritv ’): a 
Help Desk for CFATS-related questions; a CFATS tip-line for anonymous chemical security 
reporting; and CFATS-Share, a web-based information-sharing portal that provides certain 
Federal, state, and local agencies access to key details on CFATS facility information as needed. 

ISCD Budget Priorities for FY 2013 

The President’s Budget for FY 2013 requested $74,544 million for the Infrastructure Security 
Compliance Program, including funds for 253 full-time positions/242 full-time equivalents 
(FTE). The primary initiatives under Infrastructure Security Compliance are the implementation 
of the CFATS Program and the development and implementation of the proposed Ammonium 
Nitrate Security Program. In helping to develop the President’s Budget, DHS considered as a 
priority the retention of basic CFATS functionality. Accordingly, DHS prioritized its funding 
request to enable DHS to thoroughly and expediently review SSPs of CFATS-covered facilities 
that pose the highest level of risk to ensure that such facilities’ security measures meet applicable 
risk-based performance standards and to expedite the performance of inspections at those 
facilities. 

Conclusion 

ISCD, NPPD, and the Department are moving forward quickly and strategically to address the 
challenges before us. CFATS is reducing the risks associated with our nation’s chemical 
infrastructure. We believe that CFATS is making the nation safer and are dedicated to its 
success. As we implement CFATS, we will continue to work with stakeholders to get the job 
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done, meet the challenges identified in the ISCD report, and execute a program to help prevent 
terrorists from exploiting chemicals or chemical facilities. 

Thank you for holding this important hearing. I would be happy to respond to any questions you 
may have. 
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The November 2011 memorandum that discussed the management of the 
Chemical Fadlity Anti-Terrorism Standards (CFATS) program was prepared 
based primarily on the observations of the former Director of the Department of 
Homeland Security's (DHS) Infrastructure Security Compliance Division (ISCD), 
a division of the Office of Infrastructure Protection (IP) within the National 
Protection and Programs Directorate (NPPD). The memorandum was intended to 
highlight various challenges that have hindered ISCD efforts to implement the 
CFATS program. According to the former Director, the challenges facing ISCD 
included not having a fully developed direction and plan for implementing the 
program, hiring staff without establishing need, and inconsistent ISCD 
leadership— factors that the Director believed place the CFATS program at risk, 
These challenges centered on three main areas; (1) human capital issues, 
including problems hiring, training, and managing ISCD staff; (2) mission issues, 
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(3) administrative issues, including concerns about NPPD and IP not supporting 
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progress. According to ISCD managers, the plan appears to be a catalyst for 
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reviewing facility security plans and developing facility inspection processes; 
those requiring completion of other items in the plan; or those awaiting action by 
others, such as approvals by ISCD leadership, ISCD appears to be heading in 
the right direction, but it is too early to tell if corrective actions are having their 
desired effect because ISCD is in the early stages of implementing them and has 
not yet established performance measures to assess results. 


According to ISCD officials, almost half of the action items included in the June 
2012 action plan require ISCD collaboration with or action by NPPD and IP. The 
ISCD memorandum stated that IP and NPPD did not provide the support needed 
to manage the CFATS program when the program was first under development. 
ISCD, IP, and NPPD officials confirmed that IP and NPPD are now providing 
needed support and stated that the action plan prompted them to work together 
to address the various human capital and administrative issues identified. 
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Chairman Shimkus, Ranking Member Green, and Members of the 
Subcommittee: 

I am pleased to be here today to discuss the Department of Homeland 
Security’s (DHS) efforts to address the various challenges in 
implementing and managing the Chemical Facility Anti-Terrorism 
Standards (CFATS) program. My statement today summarizes the 
testimony v/e delivered on July 26. 2012 before the House Committee on 
Appropriations, Subcommittee on Homeland Security.^ The events of 
September 11, 2001, triggered a national re-examination of the security of 
facilities that use or store hazardous chemicals in quantities that, in the 
event of a terrorist attack, could put large numbers of Americans at risk of 
serious injury or death. Chemicals held at these facilities can be used to 
cause harm to surrounding populations during terrorist attacks: can be 
stolen and used as chemical weapons or as precursors (the ingredients 
for making chemical weapons); or stolen and used to build an improvised 
explosive device. To mitigate this risk, the DHS appropriations act for 
fiscal year 2007^ required DHS to issue regulations to establish risk- 
based performance standards for securing high-risk chemical facilities, 
among other things.^ DHS established the CFATS program to assess the 
risk, if any, posed by chemical facilities; place high-risk facilities in one of 
four risk-based tiers; require high-risk facilities to develop security plans; 
review these plans; and inspect the facilities to ensure compliance with 
the regulatory requirements. DHS’s National Protection and Programs 
Directorate (NPPD) is responsible for the CFATS program. Within NPPD, 
the Infrastructure Security Compliance Division (ISCD), a division of the 
Office of Infrastructure Protection (IP), manages the program. 

A November 2011, internal ISCD memorandum, prepared by ISCD's 
former Director in consultation with the former Deputy Director^ and 


^GAO, Critical Infrastructure Protection; DHS Is Taking Action to Better Manage Its 
Chemical Security Program, but It Is too Early to Assess Results, GAO-12-51 5T 
(Washington, D C.: July 2012). 

^Pub. L No. 109-295, § 550, 120 Stat. 1355, 1388 (2006). 

^According to DHS, a high-risk chemical fecility is one that, in the discretion of the 
Secretary of Homeland Security, presents a high risk of significant adverse consequences 
for human life or health, national security, or critical economic assets if subjected to a 
terrorist attad<. c»mpromise, infiltration, or exploitation, 6 C.F.R. §27.105. 

^The fSCD director who prepared the internal memorandum is no longer in that position, 
and the deputy director who assisted wth the internal memorandum is now the director. 
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designated by DHS as “for official use only” (FOUO), expressed concerns 
about the management of the CFATS program. The iSCD memorandum, 
which was leaked to the media in December 201 1 , cited an array of 
challenges that, according to these officials, hindered iSCD’s ability to 
implement and manage the CFATS program.® My statement today 
discusses: (1) how the memorandum was developed and what 
challenges were identified; (2) what actions are being taken to address 
the challenges identified: and (3) the extent to which ISCD’s planned 
actions and proposed solutions require action to be taken by or in 
collaboration with NPPD or IP. 

This statement Is based on work we recently completed for this 
subcommittee on the ISCD memorandum and related actions. To conduct 
this work, we reviewed applicable laws and regulations, as well as NPPD, 
IP, and ISCD policies and procedures for administering the CFATS 
program, analyzed the ISCD memorandum prepared by the former ISCD 
Director in consultation with the former Deputy Director, compared it with 
the proposed action plan ISCD officials prepared to address tiie 
challenges Identified, and compared subsequent action plans to monitor 
ISCD’s progress.® Our results are based on the ISCD’s action plan as of 
June 2012 so these results reflect the status of ISCD’s progress up to that 
point in time. The details of our scope and methodology can be found in 
our July 2012 statement. In August 2012, ISCD provided us with an 
updated action plan which we used to document the additional action 
items completed between June 2012 and August 2012. We did not verify 
the status of these action items. 

We conducted this performance audit from February 2012 to July 2012 in 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our analysis based 
on our audit objectives. 


^According to DHS officials, the ISCD memorandum was never intended to be publically 
released. 

®We initially reviewed an ISCD action plan developed in January 2012, ISCD periodicaity 
updated the plan to monitor progress on the action items and we reviewed 8 versions of 
the action plan up to and including one developed in June 2012. 
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Background 


Section 550 of the OHS appropriations act for fiscal year 2007' requires 
DHS to issue regulations establishing risk-based performance standards® 
for the security of facilities that the Secretary determines to present high 
levels of security risk, among other things. The CFATS rule was 
published in April 2007® and Appendix A to the rule, published in 
November 2007, listed 322 chemicals of interest and the screening 
threshold quantities for each,'” ISCD has direct responsibility for 
implementing DHS’s CFATS rule, including assessing potential risks and 
identifying high-risk chemical facilities, promoting effective security 
planning, and ensuring that final high-risk facilities meet the applicable 
risk-based performance standards though site security plans approved by 
DHS. ISCD is managed by a Director and a Deputy Director and operates 
five branches that are, among other things, responsible for information 
technology operations, policy and planning, and providing compliance 
and technical support. From fiscal years 2007 through 2012, DHS 
dedicated about $442 million to the CFATS program. During fiscal year 
2012, ISCD was authorized 242 full-time-equivalent positions. For fiscal 
year 2013, DHS's budget request for the CFATS program was $75 million 
and 242 positions. 


'Pub. L, No. 109-296, § 550, 120 Star. 1355, 1388 (2006). 

®The CFATS rule establishes 18 risk-based performance standards that identify the areas 
for which a facility's security posture are to be examined, such as perimeter security, 
access control, and cyber security. To meet these standards, facilities are free to choose 
whatever security programs or processes they deem appropriate so long as DHS 
determines that the facilities achieve the requisite levei of performance in each applicable 
standard 

®72 Fed. Reg. 17,688 (Apr. 9. 2007) (codified at 6 C.F.R. pt, 27). 

^°72 Fed- Reg. 65,396 (Nov. 20, 2007). According to DHS, CFATS not only covers 
facilities that manufacture chemicals but also covers facilities that store or use certain 
chemicals as part of their daily operations. This can include food-manufacturing facilities 
that use chemicals of interest in the manufacturing process, farms that use certain 
quantities of ammonium nitrate or urea fertilizers, or universities that use chemicals to do 
experiments. 
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Senior ISCD Leaders 
Developed the ISCD 
Memorandum to 
Highlight Various 
Challenges Hindering 
CFATS 

Implementation 


ISCD’s Memorandum 
Based Largely on 
Observations of Senior 
ISCD Managers 


Our review of the ISCD memorandum and discussions with ISCD officials 
showed that the memorandum was developed during the latter part of 
201 1 and was developed primarily based on discussions with ISCD staff 
and the observations of the ISCD former Director in consultation with the 
former Deputy Director. In November 201 1 , the former Director and 
Deputy Director provided the Under Secretary with the ISCD 
memorandum entitled “Challenges Facing ISCD, and the Path Forward.” 
These officials stated that the memorandum was developed to inform 
leadership about the status of ISCD, the challenges it was facing, and the 
proposed solutions identified to date. In transmitting a copy of the 
memorandum to congressional stakeholders following the leak in 
December 201 1 . the NPPD Under Secretary discussed caveats about the 
memorandum, including that it had not undergone the normal review 
process by DHS's Executive Secretariat and contained opinions and 
conclusions that did not reflect the position of DHS. 


The former ISCD Director stated that the memo was intended to begin a 
dialog about the program and challenges it faced. The former Director 
confirmed that she developed the memorandum by (1) surveying division 
staff to obtain their opinions on program strengths, challenges, and 
recommendations for improvement; (2) observing CFATS program 
operations, including the security plan review process; and (3) analyzing 
an internal DHS report on CFATS operations,” which, according to the 
former Director served as a basis for identifying some administrative 
challenges and corrective action. The senior ISCD and NPPD officials we 
contacted said that they generally agreed with the material that they saw. 


”DHS Office of Compliance and Security, National Protection and Programs Directorate, 
Infrastructure Security Cmipliance Division (ISCD) Program Inspection, Aprii-September, 
2011 . 
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but noted that they believed the memorandum was missing context and 
balance. For example, one NPPD official stated that that the tone of the 
memorandum was too negative and the problems it discussed were not 
supported by sound evaluation. However, the official expressed the view 
that the CFATS program is now on the right track. 


ISCD Management Was 
Concerned That 
Challenges Place the 
CFATS Program at Risk 


The ISCD memorandum discussed numerous challenges that, according 
to the former Director, pose a risk to the program. The former Director 
pointed out that, among other things, ISCD had not approved any site 
security plans or carried out any compliance inspections on regulated 
facilities. The former Director attributed this to various management 
challenges, including a lack of planning, poor internal controls, and a 
workforce whose skills were inadequate to fulfill the program’s mission, 
and highlighted several challenges that have had an impact on the 
progress of the program. In addition, the memorandum provided a 
detailed discussion of the issues or problems facing ISCD, grouped into 
three categories; (1) human capital management, such as poor staffing 
decisions: (2) mission issues, such as the lack of an established 
inspection process; and (3) administrative issues, such as a lack of 
infrastructure and support, both within ISCD and on the part of NPPD and 
IP. 


ISCD Has Begun to 
Take Various Actions 
Intended to Address 
Challenges Identified 

ISCD’s Action Plan ISCD is using an action plan to track its progress addressing the 

Included Time Frames and challenges identified in the memorandum, and, according to senior 
Appears to be Helping division officials, the plan may be helping them address some legacy 

Address Some Legacy wfe attempting to deal with before the memorandum 

T was developed. The January 2012 version of the proposed action plan 

issues Ijgjg^ g.j aQtjons to be taken categorized by issue— human capital 

management Issues, mission issues, or administrative issues — ^that, 
according to the former ISCD Director, were developed to be consistent 
with the ISCD memorandum. However, the January 2012 version of the 
action plan did not provide information on when the action was started or 
to be finished. Eleven of the 12 ISCD managers {other than the former 
Director and Deputy Director) assigned to work as the coordinators of the 


Page 5 


GAO-1 2-567T 




28 


individual action items told us that even though they were not given the 
opportunity to view the final version of the iSCD memorandum, the former 
Director provided them the sections of the action plan for which they were 
responsible to help them develop and implement any corrective actions. 
They said that they agreed that actions being taken in the plan were 
needed to resolve challenges facing ISCD. Our discussions with these 
officials also showed that about 39 percent (37 of 94) of the items in the 
March and June 2012 action plans addressed some legacy issues that 
were previously identified and, according to these officials, corrective 
actions were already undenvay for all 37 of these items. 


ISCD’s June 2012 Plan Our analysis of the June 2012 version of the ISCD action plan showed 

Update Showed 38 Action 40 percent of the items in the plan (38 of 94) had been completed. 

Items Completed remaining 60 percent (56 of 94) were in progress. Of the 38 

completed items, we determined that 32 were associated with human 
capital management and administrative issues, including those involving 
culture and human resources, contracting, and documentation. The 
remaining 6 of 38 action items categorized by ISCD as completed were 
associated with mission issues. Figure 1 shows the status of action items 
by each of the three categories as of June 2012. 


Figure 1: Status of ISCD Action Plan by Category, as of June 2012 
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For the remainlr^g 56 items that were in progress as of June 201 2, 40 
involved human capital management and administrative issues. 

According to ISCD officials, these 40 issues generally involved longer- 
term efforts — such as organizational realignment— or those that require 
approval or additional action on the part of IP or NPPD. Sixteen of 56 
remaining actions items in progress covered mission issues that will likely 
also require long-term efforts to address. 

As of August 2012, ISCD reported that it had completed another 21 action 
items, of which 8 were to address mission-related issues. We did not 
verify ISCD’s efforts to complete actions since June 2012. However, we 
have recently begun a follow-up review of CFATS at the request of this 
and other committees, which will focus on DHS's efforts to address 
mission-related issues. We expect to report the results of these efforts 
early In 2013. 


Almost Half of ISCD’s 
Action Item Completion 
Dates Had Been Extended 
since April 2012 


Our analysis of the April and June versions of the plan shows that the 
division had extended the estimated completion dates for nearly half of 
the action items. Estimated completion dates for 52 percent (48 of 93 
items) either did not change (37 items) or the date displayed in the June 
2012 plan was earlier than the date in the April 2012 version of the plan 
(1 1 items). Conversely, 48 percent (45 of 93) of the items in the June 
2012 version of the plan had estimated completion dates that had been 
extended beyond the date in the April 2012 plan, Figure 2 shows the 
extent to which action plan items were completed earlier than planned, 
did not change, or were extended, from April 2012 through June 2012, for 
the human capital management, mission, and administrative Issues 
identified In the plan. 


'’^JSCD data showed that 93 of 94 actton items were consistent between the April 2012 
and June 2012 action plans; therefore, computation of the estimated completion dates 
was based on 93 total items. One action item in the April 201 2 plan dealing with strategies 
for managing ISCD funding levels was removed from the June 2012 plan because after 
the analysis was prepared and submitted to NPPD, the decision was made to delete the 
item from the plan. The funding action item was replaced in the June 2012 action plan with 
an action item to conduct a peer review of the facility tiering process and formula. For 
purposes of teis analysis, we used frie 93 action items (instead of 94 action items) that 
were consistent between the April and June 2012 action plans. 
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Figure 2: Change in CFATS Action Plans Estimated Completion Dates from April 2012 to June 2012 




Source: GAO ar^eit of ISCOdeta. 

*1SCD data showed that 93 of 94 action items were consistent between the April 201 2 and June 201 2 
action plans, therefore, computation of the estimated completion dates was based on 93 total items. 
One action item in the April 2012 plan dealing with strategies for managing ISCD funding levels was 
removed from the June 2012 plan because after the analysis was prepared and submitted to NPPD, 
the decision was made to delete the item from the plan. The funding action item was replaced in the 
June 2012 with an action item to conduct a peer review of the facility tieiing process and formula. For 
purposes of this analysis, we used the 93 action items that were consistent between the April and 
June 2012 action plans. 


ISCD officials told us that estimated completion dates had been extended 
for various reasons. For example, one reason for moving these dates was 
that the work required to address some items was not fully defined when 
the plan was first developed and as the requirements were better defined, 
the estimated completion dates were revised and updated, in addition, 
ISCD officials also stated that timelines had been adversely affected for 
some action items because staff had been reassigned to work on higher 
priority responsibilities, such as reducing the backlog of security plans 
under review. 


Action Plan Performance ISCD, through its action plan, appears to be heading in the right direction 


Measures Could Help 
Gauge Progress 


towards addressing the challenges identified, but it is too early to tell if the 
action plan is having the desired effect because (1) the division had only 
recently completed some action items and continues to work on 


completing more than half of the others, some of which entail long-term 
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changes, and (2) ISCD had not yet developed an approach for measuring 
the results of its efforts. ISCD officials told us that they had not yet begun 
to plan or develop any measures, metrics, or other documentation 
focused on measuring the impact of the action plan on overall CFATS 
implementation because they plan to wait until corrective action on all 
items has been completed before they can determine the impact of the 
plan on the CFATS program. For the near term, ISCD officials stated that 
they plan to assess at a high level the impact of the action plan on 
CFATS program implementation by comparing ISCD's performance rates 
and metrics pre-action plan implementation and post-action plan 
implementation.''^ However, because ISCD will not be completing some 
action items until 2014, it will be difficult for ISCD officials to obtain a 
complete understanding of the impact of the plan on the program using 
this comparison only. 

In our duly 2012 statement, we recommended that ISCD look for 
opportunities, where practical, to measure results of their efforts to 
Implement particular action items, and where performance measures can 
be developed, periodically monitor these measures and indicators to 
identify where corrective actions, if any, are needed. The agency 
concurred with our recommendation and developed a new action item 
(number 95) intended to develop metrics for measuring, where practical, 
results of efforts to implement action plan items, including processes for 
periodic monitoring and indicators for corrective actions. This action item 
is in progress. 


ISCD Officials Stated 
That Almost Half of 
the Action Items 
Required 

Collaboration with or 
Action by NPPD or IP 


According to ISCD officials, almost half of the action Items included in the 
June 2012 action plan either require ISCD to collaborate with NPPD and 
IP or require NPPD and IP to take action to address the challenges 
identified in the ISCD memorandum. NPPD, IP, and ISCD officials have 
been working together to identify solutions to the challenges the 
memorandum identified and to close pertinent action items. According to 
division officials, 46 of the 94 action items included in the June 2012 
action plan required action either by NPPD and IP or collaboration with 
NPPD and IP. This includes collaborating with NPPD officials 


^^According to ISCD officials. ISCD uses a performance measure to track the 
perfomianceofthe CFATS program overall, but as of June 2012 did not have 
performance measures in place to track the progress of the action plan, or particular 
action items. 
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representing the NPPD human capital, facilities, and employee and labor 
relations offices, among others, and with IP’s Directorate of Management 
Office.” As of June 2012, 13 of the 46 items that require action by or 
collaboration with NPPD or IP were complete; 33 of 46 were in progress. 
As of August 201 2, ISCD reported that it had completed 8 more of these 
action items, such that 21 of the 46 were complete and 25 were in 
progress. We did not verify ISCD’s efforts to close these additional action 
items. 


Chairman Shimkus, Ranking Member Green, and members of the 
subcommittee, this completes my prepared statement. I would be happy 
to respond to any questions you may have at this time. 
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QUESTIONING OF RAND BEERS, UNDER SECRETARY, NA- 
TIONAL PROTECTION AND PROGRAMS DIRECTORATE, DE- 
PARTMENT OF HOMELAND SECURITY, ACCOMPANIED BY 
DAVID WULF, DIRECTOR, INFRASTRUCTURE SECURITY COM- 
PLIANCE DIVISION, OFFICE OF INFRASTRUCTURE PROTEC- 
TION, NATIONAL PROTECTION AND PROGRAMS DIREC- 
TORATE, DEPARTMENT OF HOMELAND SECURITY; AND 
CATHLEEN A. BERRICK, MANAGING DIRECTOR, HOMELAND 
SECURITY AND JUSTICE, GOVERNMENT ACCOUNTABILITY 
OFFICE 

Mr. Shimkus. And so I will start. 

Mr. Beers, it is my understanding from your Web site that you 
have one facility that is approved under the program. And of that 
one, what is its plan on personnel assurance? 

Mr. Beers. Sir, we have now two plans that have been approved. 
Those approvals are conditional pending the completion of the re- 
sponse to Risk-Based Performance Standard 12 , which is the per- 
sonnel surety standard. So we are working actively now to reintro- 
duce the request to 0MB for the collection program that we need 
to move forward. 

But let me say three things about that. 

Mr. Shimkus. Quickly. 

Mr. Beers. First, Ranking Member Green, TWIG will be in- 
cluded in that. 

We will also have the opportunity for entire companies and serv- 
ice providers to be able to submit for their entire companies. And 
they will be authorized to go to any plant that they go to that is 
covered by this program. 

And, thirdly, we are going to work this program heavily with in- 
dustry to make sure that we move as quickly as possible, but recog- 
nizing their needs, as well. 

Mr. Shimkus. You understand my concern. If we have two that 
are approved and we still don’t have the personnel assurance issue, 
it is hard for me to understand how we say it is conditionally ap- 
proved without the whole ball game — a standard being reached 
across the board. I know we want to send positive signals, but we 
don’t want to send false signals, either, that we are better off and 
we have a full program. 

Do you want to respond, Mr. Beers? 

Mr. Beers. Sir, I totally agree with you that we don’t want to 
leave any security requirement not fulfilled. But it was our view 
that the conditional authorization process, because of the slowness 
with which we were getting the necessary personnel surety ques- 
tions answered, meant that we believe that we ought to move for- 
ward with the conditional authorization and catch up as quickly as 
possible with the personnel assurance. 

Mr. Shimkus. OK. 

Let me move to the — the last hearing, we also had an issue be- 
cause all facilities were placed into the same tier. So we had a big 
debate about, how do we get risk tiering, and what is the method- 
ology, and let’s make sure we have the proper people doing that. 

And my understanding is, risk tiering is a formula; is that cor- 
rect? 

Mr. Beers. Yes, sir. 
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Mr. Shimkus. We have a formula to do that. And what comprises 
the formula? 

Mr. Beers. Sir, there are a series of factors that are involved in 
that formula. First of all, we 

Mr. Shimkus. We have to go quickly. 

Mr. Beers. The 

Mr. Shimkus. How about if I just help out here? Threat times 
vulnerability times consequence is the risk factor, correct? 

Mr. Beers. That is the essential equation, and then each of those 
elements has sub-elements within it. 

Mr. Shimkus. So let me ask about, how do you — I don’t claim to 
be a great mathematician,but I understand formulas and I under- 
stand constants and I understand variables. One of our concerns is 
that vulnerability you have as a constant versus a variable, and 
that concerns us in the formula. 

In fact, I would like to go to the GAO. Did you know that, in this 
formula, that for that issue of vulnerability, that vulnerability is 
listed as a constant and not a variable? 

Ms. Berrick. We do know that. Chairman, and we are looking 
at that right now. 

I think the specifics of this are for official use only. But to talk 
about this at an unclassified level, we found a similar — we look at 
how DHS calculates risk scores across the Department as a part 
of a number of our reviews. We found a similar problem in how 
they calculate risk for a major grant program and, in fact, rec- 
ommended that they not hold vulnerability constant. DHS imple- 
mented that recommendation in the last grant cycle and varied it. 

So we have cited that as a concern in past work. 

Mr. Shimkus. And the point being, two similar facilities — one in 
downtown Manhattan; one outside Olney, Illinois — two very dif- 
ferent risk portfolios. And so that is why we would argue that there 
should be a variable aspect on that formula. 

And from last time, how do you move a facility through the site 
security process, approve SSPs, inspect, et cetera, when there is no 
personnel surety plan that assures a facility manager that no one 
in the plant is on the terrorist watch list? It is kind of going back 
to the previous question. 

Mr. Beers. Sir, there is more to the site security plan than sim- 
ply the individuals involved, which is not to say that that is not 
a very significant and important part. So the question is, what are 
the other security provisions within the plan that we and they can 
record and review and inspect? 

Mr. Shimkus. Thank you. My time is expired, but I want to keep 
this going, and I appreciate that response. 

I would just say that, in chemical facilities, probably the biggest 
threat would be someone internally being able to get inside the fa- 
cility and know the facility. So of all of the threats, that is probably 
the biggest one, I would venture to guess. 

So, with that, I would yield to the ranking member, Mr. Green, 
for 5 minutes. 

Mr. Green. Thank you, Mr. Chairman. 

Secretary Beers, as of 2 days ago, the Tier 1 site plans reviewed 
or authorized were 73, and 2 that were approved. 
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What does “conditionally authorized” mean? Does that mean that 
they can continue to operate? Or is there 

Mr. Beers. That means that they can move forward with imple- 
mentation of the site security plan elements that were approved, 
and that we come back when we have a personnel surety program 
that we have agreed on and implement those. 

But let me just make one point with respect to personnel surety. 
It is not that this government has been quiet or inattentive to look- 
ing at insider threats within this area. FBI, which we work in part- 
nership with, has a very robust program of looking for threats 
within the country and ensuring that they are being inspected. 
This program would be an additional program to the excellent work 
that the FBI is doing on a daily basis. 

Mr. Green. How long does it take to get a plan from condi- 
tionally approved to approved? 

Mr. Beers. That is going to depend, sir, on when the personnel 
surety risk-based performance standards — excuse me — when we 
agree on what the standards are that they are supposed to meet. 

So, right now, we are looking at publishing the request for infor- 
mation in the next 30 days and collecting that information over a 
60-day period, and then going forward with our proposal to 0MB. 

Mr. Green. You mentioned that as of July the 16th, in your 
statement, ISCD has resumed authorization inspections on Tier 1 
facilities. How many inspections, on the average, are you con- 
ducting a month? 

Mr. Beers. David, do you want to answer that question? 

Mr. WULF. We have a total of about 10 inspections scheduled 
during the month of September. We anticipate continuing to in- 
crease the pace of inspections going forward. So I think, you know, 
you will see hundreds of inspections occurring over the course of 
the next year. 

Mr. Green. OK. At that rate, how long do you think it will take 
to get to all those sites that are awaiting inspection? A year? 

Mr. WuLF. Well, the sites that are awaiting inspection are those 
that have received their authorization, and right now those are 73 
sites. Several of those have already been inspected. We have con- 
ducted a total of 19 authorization inspections to this point. The re- 
mainder of those 73 and additional ones that we anticipate author- 
izing over the next months will certainly be inspected in the next 
year. 

Mr. Green. And I would hope folks are moving into the condi- 
tional authorization, so that group will be expanding, I assume. 

Mr. WULF. Yes, the numbers of finally approved SSPs will cer- 
tainly be, you know, continuing to grow. 

Mr. Green. Given the current status of the SSP tool, has DHS 
explored how to better use the authority, use alternative security 
plans to help expedite the CFATS approval process? 

Mr. Beers. Yes, sir. That is an important element of our efforts. 
We have been working with the American Chemistry Council. We 
have run a pilot program with an alternative security plan with 
them and are hoping to issue some guidance for the members of 
that council to be able to use the alternative security plan. We are 
also working with agricultural industries, looking at the same pos- 
sibility. 
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Mr. Green. OK. Well, I appreciate you being willing to use simi- 
lar credential programs like TWIG. The Federal Government really 
doesn’t need to reinvent the wheel. TWIG is not perfect, believe me, 
as I learned when it was rolled out and we will see as we do the 
reissuing of them. But we need to learn from that and have one 
ID, whether you are on water side or on land side, your facility. 

The internal DHS memo leaked to the press last year articulated 
programmatic breakdowns, serious deficiencies. What is the 
timeline for the full implementation of the 91 recommendations for 
improving the CFATS program? 

Mr. Beers. Sir, with respect to all 95 now of those, some of them 
are going to go on over a longer period of time, but we are moving 
as quickly as possible. We have, since we submitted the testimony, 
the written testimony with the September 4 deadline, increased the 
number of items that have been completed. 

And, David, I don’t want to speak to the precise number, but 
when would you say we would be up in the 80s? 

Mr. WULE. I would say we will be in the 80s by the end of the 
calendar year, most likely. 

Mr. Green. OK. 

Mr. Chairman, I am out of time, and I have one question on the 
site security plan I would like to submit and hear the answer. And 
I appreciate you all for getting back to us. 

Mr. Shimkus. Thank you. Without objection. 

The chair recognizes the vice chair of the subcommittee, Mr. 
Murphy, for 5 minutes. 

Mr. Murphy. Thank you, Mr. Chairman. 

And thank you to our witnesses today. 

I just want to verify. So the number of site security plans that 
have been approved is two? 

Mr. WULE. Two, sir. 

Mr. Murphy. You got the funding in 2006 to go forward on this; 
am I correct? 

Mr. Beers. Excuse me? 

Mr. Murphy. The funding came forth to start these inspections 
in 2006; is that correct? 2007? It was a few years ago? 

Mr. Beers. I don’t know whether it came forward in — the author- 
ization occurred then. 

Mr. Murphy. Authorization, OK. 

Mr. Beers. But we have not been in a position to actually finally 
approve them, really, until this summer, in part because of the 
management problems that have been revealed and in part because 
as we have gone forward with the program we have learned a 
whole lot. And the whole lot that we have learned has also created 
the appreciation that it was more complicated than it was origi- 
nally thought to be at the beginning of the program. 

Mr. Murphy. So how long have you been getting the money, and 
how much money is it you have been receiving to do this, then? 

Mr. Beers. I believe the total amount of money that we have re- 
ceived is slightly under $500 million. 

David? 

Mr. WULF. Yes, I think on the order of $400 million, $450 mil- 
lion. 
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Mr. Murphy. Wow. And we still have, what, over 4,000 plans to 
review? 

Mr. Beers. We have about 4,400 plans to review. We have 4,433 
facilities that have heen designated or have preliminary designa- 
tions as being in the high-risk category. 

Mr. Murphy. So we hope this goes better because, otherwise, you 
are at the rate of approving them all within a few centuries, and 
we wanted to help you speed that up. 

You have said that the inspectors weren’t well-trained and there 
was a number of problems. How many inspectors are trained now? 

Mr. Beers. All the inspectors that we have. The number is over 
100. A hundred and fourteen, I believe, is the actual number. And 
that training about doing the inspections was completed during the 
month of July. 

Mr. Murphy. And they are all qualified to do the inspections? 

Mr. Beers. Yes, sir. 

Mr. Murphy. How many inspectors are needed to do each plan? 

Mr. Beers. We have a planned workforce that is in — David, 
about 120-something overall? 

Mr. WULF. Yes, yes, we do. And that will encompass ammonium 
nitrate inspections when that program comes on line. 

Mr. Murphy. But, I mean, how many people do you need for 
doing each one? 

Mr. WuLF. It varies depending on the size and scope of the facil- 
ity, but, you know, I would say anywhere from two to three, four, 
five. 

Mr. Murphy. So I am still looking here at — ^you have about $2 
million per person there to do this, and you need two or three to 
do each one. Using those kinds of numbers and those figures, when 
do you anticipate you will even reach the halfway point with these 
inspections? 

Mr. WuLF. We anticipate within the next year that we will have, 
you know, authorized, conducted inspections. And if all goes well 
with the site security plans, we will have approved close to 300 
plans. 

Mr. Murphy. That still leaves us 3,500 or so to do. I know you 
are concerned, and we are too. I am trying to find ways we can 
help you. 

Mr. Shimkus. Would the gentleman yield for 1 second? 

Mr. Murphy. Yes. 

Mr. Shimkus. What I would weigh in is, that is why we need to 
properly tier the facilities. And that is why this debate that is 
going on about alternative security plans is very, very important, 
so that we use the plans that are already established out there in 
industry which are trying to do the same thing, for the most part, 
and work together versus against each other. 

Mr. Murphy. Precisely. No, no, I want to work together. I am 
just trying to find out if there are specific recommendations of 
things you need from us to facilitate that in moving forward. Be- 
cause we know you want to be accurate, and we know you want 
to do this in a way that protects public safety and works with the 
things that industry has found. 

And so I am wondering, in the process of going through, are you 
finding ways in this that, in addition to the people that you have 
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approved for the inspections, which the chairman was mentioning, 
within the industry, can facilitate that and actually speed up this 
process in a way that helps too? Is there something that we can 
learn from that? 

Mr. Beers. Sir, that is in large measure what we are about right 
now, which is to ensure that the people are trained, to ensure that 
the review process to get the plans to the authorization stage so 
that we can send out the inspectors to do that moves more quickly 
and more efficiently than it has in the past. 

And I think that the record since the review process to make the 
internal reviews go faster has shown an increase. I think that the 
inspection plan training has increased the number of inspections. 
So I think we are moving at a rate that is going to be increasing. 

But I have to say here, sir, it will not help us if the House Appro- 
priations Committee appropriation level for this program, which 
cut $40 million 

Mr. Murphy. If I might add, I know oftentimes when I am vis- 
iting businesses, they are very concerned that government seems to 
come in, work against them, doesn’t ask them for their assistance. 
And I would like to echo what the chairman said, that, I mean, 
these are people who also care about their communities, their fami- 
lies, their workers. And I hope that you do talk with them and see 
what you can learn from so many of these companies because they 
do want to facilitate and move this forward. 

And I yield back. Thank you. 

Mr. Shimkus. The gentleman yields back his time. 

It is tough to argue dollars and cents when we have a track 
record of millions of dollars per individual. So I wouldn’t go down 
that route, Mr. Beers. 

The chair would now recognize my colleague from North Caro- 
lina, Mr. Butterfield, for 5 minutes. 

Mr. Butterfield. Let me thank you very much, Mr. Chairman, 
and certainly thank the three witnesses for coming forward today 
with your testimony. 

I am going to not take up the entire 5 minutes, but I do want 
to ask Secretary Beers and possibly Mr. Wulf a very short question. 

I am told that the Department has a hotline for whistleblowers. 
That is what my staff tells me, that there is now in place a hotline 
for whistleblowers and that anyone can call that hotline with secu- 
rity concerns. 

Department employees have whistleblower protections, but what 
protections, if any, cover facility employees and even the general 
public? Mr. Beers, can you help me with that? 

Mr. Beers. I am going to turn to David to answer the question 
about the hotline. 

But it is certainly our view that we solicit both from within the 
Department of Homeland Security and from the private sector and 
from citizens any indication of issues that we ought to pay atten- 
tion to. 

The protection involved there will be that we will provide ano- 
nymity if anonymity is requested. That is a basic policy of hotlines, 
if that is what the person wants. So if it is from an employee of 
the company, we will keep that 

Mr. Butterfield. What about downstream at the facilities? 
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Mr. Beers. Yes. 

Mr. Butterfield. The same thing with the facilities? 

Mr. Beers. Yes. I mean, insofar as they tell us. We are not going 
to reveal the names of the individuals who gave us that informa- 
tion if they want their identity protected. 

Mr. Butterfield. And the same with the general public? 

Mr. Beers. And the same for the general public, yes, sir. 

Mr. Butterfield. All right. 

Mr. WULF. And we do maintain, as the Under Secretary noted, 
a tip line, a CFATS-focused tip line, so members of the public, facil- 
ity personnel can call in and report concerns, can report informa- 
tion about facilities that may, you know, benefit from being part of 
the CFATS program. 

Mr. Butterfield. All right. 

More than 2,700 facilities have eliminated or reduced holdings of 
dangerouschemicals, so they are no longer considered high-risk fa- 
cilities. How does DHS ensure those facilities do not increase the 
amount of those chemicals in their inventory at a later date? 

Mr. Beers. David? 

Mr. WuLF. Well, those facilities — and, you know, if I can men- 
tion, you know, that is one of the many successes that we view in 
the CFATS program to this point. And there is a pretty significant 
list of things that America has received for its investment in 
CFATS. 

But with regard to those facilities, having been part of the pro- 
gram, having gone through the initial Top-Screen, they are made 
aware of their obligation when they bring into the facility chemi- 
cals above the screening threshold quantity that are on the list of 
322 chemicals of interest, their obligation to report that to us. So 
they are fully aware of that and, you know, meet those obligations. 
So facilities come back into the program, as well. 

Mr. Butterfield. OK. 

And now to the managing director: The Department of Homeland 
Security Infrastructure Security Compliance Division completed 21 
of 94 items from its action plan between June and September of 
this year. And prior to that, the Department had only completed 
38 items. 

Is DHS now completing the 94-item action plan at a faster rate 
than the GAO anticipated? 

Ms. Berrick. I think they are making good process on the action 
plan. They demonstrated their commitment. They are actively 
tracking it. We had some suggestions to provide some additional 
details on the plan, which they have incorporated. 

The one thing I would mention about the action plan, I think it 
is a very good first step. However, you know, to address these 
issues that were highlighted in the management memo is going to 
take leadership, sustained leadership, support over the long term. 

Some of these action plans are designed to develop plans to, you 
know, implement a program — for example, a framework to create 
a quality division. While that is very important, the actual execu- 
tion of this quality division, how they oversee this process, is really 
what is going to be critical. 

So we think it is a very good first step, but it is going to require 
long-term and sustained leadership support to refine these actions. 
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update them as needed, and make sure that they execute on the 
plans that they have put in place. 

Mr. Butterfield. All right. 

And I will end where I began, with Mr. Beers or Mr. Wulf. You 
mentioned that 73 facilities have authorized or have conditionally 
authorized Tier 1 security plans. Are there any additional steps 
those facilities must complete before inspection and approval? 

Mr. Beers. No, sir. That means that they are ready for inspec- 
tion. The ones that haven’t been authorized or conditionally author- 
ized either need to provide more data or we need to have a better 
understanding of the data that they did provide. 

Mr. Butterfield. Do the steps vary across facilities? 

Mr. Beers. Excuse me? 

Mr. Butterfield. Do the final steps vary across the different fa- 
cilities? 

Mr. Beers. Well, no facility is necessarily the same, so what they 
need to do in order to meet the Risk-Based Performance Standards 
may be different for each facility, which means that there is no 
automatic template, when you look at a response, that either it is 
“yes” or “no.” You have to look at what they actually said with re- 
spect to that particular performance standard and make sure that 
it matches what the performance standard lays out. 

Mr. Shimkus. The gentleman’s time has expired. 

Mr. Butterfield. Thank you, Mr. Chairman. 

Mr. Shimkus. The chair now recognizes the gentleman from Col- 
orado, Mr. Gardner, for 5 minutes. 

Mr. Gardner. Thank you, Mr. Chairman. 

And thank you to the witnesses for joining us today. 

Mr. Beers, I want to ask a couple of questions to follow up on 
a committee hearing we had February 3rd, 2012. I want to read the 
transcript from about 30 seconds’ worth of our conversation. 

I started the conversation by asking about the Anderson Wulf 
memorandum and said, “So the inspector general has looked into 
this?” 

And your response was, “The inspector general has access to 
these reports, yes, sir, but this was not done by — " 

And I stated, “Have you had conversations with the inspector 
general?” 

Mr. Beers: “With respect to this report?” 

“Yes.” 

Mr. Beers: “I can’t speak to that. I have not personally had that 
conversation.” 

And I followed up with, “But he has this memorandum?” 

Your response to that was, “As with all these kinds of reports, 
yes, they are available.” 

“They are available, or he has them? I mean, you have sent it 
to him?” 

Your response was, “I will have to confirm that, sir.” 

And so, Mr. Beers, to follow up with that, you never did get back 
to me or to the committee to confirm that you had given the Ander- 
son memo to the inspector general, did you? 

Mr. Beers. Yes, sir. 

Mr. Gardner. You got back to us? 
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Mr. Beers. I am sorry, I am not certain that we got back to you. 
But, yes, they have it. 

Mr. Gardner. OK. But I don’t think you got back to me. I cer- 
tainly never received the information. You didn’t get back to this 
committee. 

But it was after this committee hearing, it was after the Feb- 
ruary 3rd committee hearing, when the inspector general had 
watched the broadcast of our interaction, and it was more than a 
month after it was all over the national news and 2 months after 
you received the memorandum that the IG called you to obtain the 
memorandum. Is that correct? 

Mr. Beers. We had a conversation immediately after this hear- 
ing, yes, sir. 

Mr. Gardner. And when did he get the report then? 

Mr. Beers. I can’t say the specific day on which he got it. 

Mr. Gardner. It was 2 month after the conversation. 

And, again, you didn’t give it to him right away after the com- 
mittee hearing. After that conversation, did you give it to him right 
away? Surely you remember that. 

Mr. Beers. I did not personally give it to him. I asked my staff 
that it be given to him immediately, per the conversation that he 
and I had. 

Mr. Gardner. And staff was directed to immediately give it to 
him? 

Mr. Beers. Yes, sir. 

Mr. Gardner. And the memorandum, though, didn’t go out until 
May. Is that correct? 

Mr. Beers. Sir, I don’t have that information. 

Mr. Gardner. Do you have staff here that could answer that? 

Mr. Beers. David? 

Mr. WULF. I don’t believe I can answer that, sir. 

Mr. Gardner. And so, here is the problem that I have. And that 
is why I would ask you for the full story here. 

How many times have you ever communicated with either Rich- 
ard Skinner or Charles Edwards, in their respective positions as in- 
spector general at DHS or the acting inspector general, or anyone 
else from the DHS Inspector General Office about the CFATS pro- 
gram? 

Mr. Beers. I have talked to Mr. Edwards on at least, I want to 
say — I am positive that I have spoken to him on at least three occa- 
sions. And I could have had other conversations with him beyond 
that, but I don’t recall. 

Mr. Gardner. And were those conversations started by you, or 
were they initiated by — who initiated those conversations? 

Mr. Beers. In one case, it was him. In the other cases, it was 
me. 

Mr. Gardner. And so, you know, have you discussed the conduct 
of an audit inspection or investigation of the CFATS program? Was 
that the purpose of the conversation? 

Mr. Beers. We had a conversation about that, yes. 

Mr. Gardner. And that was a conversation that you started or 
that they started? 

Mr. Beers. I believe that was one that I started. 



44 


Mr. Gardner. And have you or anyone in NPPD, IP, or ISCD 
ever suggested that the Homeland Security inspector general come 
in and look at the problems being encountered by CFATS? 

Mr. Beers. Sir, as a result of that round of hearings, a Member 
of Congress requested the IG to come in and look at it. When 

Mr. Gardner. But you never? 

Mr. Beers. When he and I had the conversation about the man- 
agement report, I did not request that he come in and look at it, 
but I certainly said we are open to anything that you believe is ap- 
propriate to looking at this program. 

Mr. Gardner. And so the recommendations by — so nobody, 
again, nobody in NPPD, IP, or ISCD ever suggested that? 

Mr. Beers To? 

Mr. Gardner. To come in and look at the problems being en- 
countered by CFATS. That was all a Member of Congress that sug- 
gested that. 

Mr. Beers. There was a discussion in the fall of 2010 as to 
whether or not the inspector general should be invited to conduct 
a management review, which would have required us to pay them 
to hire an outside consultant to conduct that review. When we 
looked at 

Mr. Gardner. And that was a suggestion that they had made? 

Mr. Beers. Excuse me? 

Mr. Gardner. That was a suggestion that somebody in one of 
the 

Mr. Beers. That was a suggestion that Assistant Secretary Todd 
Keil made in a memo 

Mr. Gardner. And so what did you do with that recommenda- 
tion? 

Mr. Beers. Excuse me? 

Mr. Gardner. What did you do with that recommendation? 

Mr. Beers. We sat down in senior leadership, including Assist- 
ant Secretary Keil, and decided that we could perform that par- 
ticular review within Office of Compliance and Security, which ex- 
ists within NPPD but not within IP, and that we could do it more 
quickly and we could do it without an additional cost to the pro- 
gram. 

And that report was done and delivered in September of 2011 
and became part of the management review that Penny Anderson 
and David Wulf undertook. The results are in that effort. 

Mr. Gardner. So just to follow up, with this most recent Feb- 
ruary 3rd hearing, the revelations in the Anderson-Wulf memo, did 
anyone — I will follow up again — did anyone in NPPD, IP, or ISCD 
ever suggest to you that DHS IG come in and look at the problems 
being encountered? 

Mr. Beers. After that hearing, no. 

Mr. Shimkus. The gentleman’s time has expired. 

Mr. Barrow, do you seek recognition? 

The chair now recognizes the gentleman from Ohio, Mr. Latta, 
for 5 minutes. 

Mr. Latta. Thank you, Mr. Chairman. 

And thank you very much for coming in today to testify again be- 
fore the committee. 
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Mr. Beers, let me ask, could you inform us of the misuse of gov- 
ernment-owned vehicles by the Washington-based headquarters 
personnel? 

Mr. Beers. I am sorry, sir? Could you repeat 

Mr. Latta. Could you inform us about any misuse of govern- 
ment-owned vehicles by Washington-based headquarters per- 
sonnel? 

Mr. Beers. Sir, I do not have an indication of that kind of mis- 
use. We did look at that issue. 

David, do you want to add to that? 

Mr. WULE. There were, before Ms. Anderson and I came into the 
division, vehicles that were housed at our headquarters location. 
Before we arrived, those vehicles had been removed. So I don’t 
have — we don’t have — we didn’t have any indication that the vehi- 
cles had been misused. But, you know, we believed their presence 
at headquarters was not necessary for the 

Mr. Latta. OK. When you say “removed,” could you explain? 
When you say “removed,” were they removed to another govern- 
ment agency? What happened to them? 

Mr. WULF. I believe — and I wasn’t there at the time — that they 
were pushed out to our field force. 

Mr. Latta. OK. But were the records kept on those vehicles prior 
to that time as to where they were going, like mileage records, 
odometer statements, gas records, et cetera? 

Mr. WULE. I don’t know that. 

Mr. Latta. Is there a way to get those records? 

Mr. Beers. Sir, I want to acknowledge, that is one of the man- 
agement problems that we discovered, that there was inadequate 
recordkeeping. And that is one of the deficiencies that we have cor- 
rected. 

Mr. Latta. OK. But I think what we need to have in the com- 
mittee, though, is we should have the — if we could request that in- 
formation. And if you have to go back and find those records — be- 
cause, again, it would seem to me that if it is a government vehicle, 
and when you have those government vehicles out there, that you 
have the odometer statements. And, also, there would be gas 
records and things like that. They would have to be filled up; they 
would have to have some service. There would have to be different 
records out there. 

So I think it is very important for the committee to get that in- 
formation from you all so we can start with that point, as to know 
exactly where those vehicles were and if they were misused. So 
that is one of the things we would like to do. 

And let me ask, just to follow up again — maybe you just men- 
tioned it — when did you all become aware of that problem with 
those vehicles? When you said you came in and those vehicles were 
removed, when were you all aware of it? 

Mr. Beers. David, fill in if I am not precise on this. 

But my understanding is that that came out in the management 
review that was done by our Office of Compliance and Security. So 
the detail about the lack of records and oversight was finally re- 
ported in September of 2011, made available to David and Penny 
Anderson for incorporation in their report. 
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Mr. Latta. Let me ask, was any of this turned over to the IG 
for investigation? 

Mr. Beers. No, sir, that was not turned over to the IG. The re- 
port itself said that there was a lack of recordkeeping but that 
there was not an indication of waste, fraud, and abuse associated 
with that. “Not an indication” — not saying that it wasn’t, but it was 
not indicated. 

Mr. Latta. OK. And, again, how many vehicles are we talking 
about in total? 

Mr. WULE. I would have to get that back to you. 

Mr. Latta. Could we get that back from you, then? We would ap- 
preciate that information. 

Mr. WuLE. A relatively small number, I believe. 

Four to six vehicles? 

Mr. Beers. That is what my staff is telling me, four to six vehi- 
cles. 

Mr. Latta. OK. 

And, Under Secretary, you were aware of the unsatisfactory con- 
dition of the SSP process before you testified back in March of last 
year and in 2012. Is that correct, that you were aware of that? 

Mr. Beers. I was aware that we were not moving at a pace that 
we had previously told you we should be moving at, yes, sir. And 
I indicated that I was disappointed in that and that I had hoped 
that we would move more rapidly on that. 

Mr. Latta. OK. And I am sorry, did you say that you brought 
those problems and that information to the committee at that time? 

Mr. Beers. Sir, which hearing are we talking about now? 

Mr. Latta. The March 2011 or the February 2012 hearing? 

Mr. Beers. So, at the March 2011 hearing, I believe I acknowl- 
edged that we had not achieved the objectives of getting the site 
security plans authorized at the rate that I had previously been 
told we would complete those plans, and that I had hoped — and I 
am now talking 2011 — that we would be in a position to move for- 
ward on that. That was, unfortunately, not an accurate statement 
at that time either. 

Mr. Shimkus. The gentleman’s time has expired. 

Mr. Latta. My time has expired, and I yield back. 

Mr. Shimkus. I would encourage my colleagues who want to go 
to the memorial service to head on down to the rotunda. We are 
going to finish with Butch Cassidy for 5 minutes, and then we will 
tell how we are going to operate after that. 

So the gentleman from Louisiana is recognized for 5 minutes. 

Mr. Cassidy. Hello, gentlemen. 

I have a lot of petrochemical plants in my State, and my workers 
and my communities are at risk. And I have to say that when I 
speak of dysfunction in Washington, you all are case number one. 
I say that not to be mean but just to kind of observe. 

In the report that was the internal report that kind of broke this 
open, there are statements such as, “Legacy employees are doing 
a tremendous amount of work, while I see others sitting at their 
desk not contributing.” 

Those folks who are not contributing, are they still with the 
agency or have they been released? 

Mr. Beers. David, would you answer that? 
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Mr. WULF. Yes, we have made a concerted effort to ensure that 
all members of our team are contributing to the program. And part 
of what we have done, as we have moved forward, kind of, toward 
a realignment of the organization, is to ensure that we can achieve 
a greater fit between the individual employees and the position in 
which 

Mr. Cassidy. Has anybody been released? Because the document 
suggested that some that were hired were totally inappropriately — 
had skill sets and attitudes that were totally inappropriate to their 
job description, making it sound more as not something that re- 
quired some adjustment, but required, frankly, rehiring. 

Has anybody been released? 

Mr. WuLF. No one has been released, but, you know 

Mr. Cassidy. Can I just keep on going then? 

They also, in that same report, said that not only had you not 
done any inspections, you had not developed a process to inspect. 
An incredible indictment. 

Are we to believe that you now have a process to inspect? 

Mr. Beers. Yes, sir. We have retrained all of the inspectors that 
are currently on board. We completed that process in July 

Mr. Cassidy. Now — I am sorry, just because we have limited 
time. I apologize to interrupt. 

It also said that because of your union contracts and your neces- 
sity to bargain even on minutia, even on things to bring into com- 
pliance with government policy, that it was anticipated that this 
could take weeks, months, it implied years, in order to actually im- 
plement the policy changes necessary to do an effective inspection. 

What has happened with that? 

Mr. Beers. Sir, we have worked with the union, and I think we 
have a productive and expedited process to have those items that 
are required to be reviewed by the union so that they move swiftly. 

But I want to turn to David, who has been managing this on a 
day-to-day. 

Mr. WuLF. And if I can just add, sir, that the point that we are 
trying to make in the “challenges” memo was that, at the early 
stage in which this program found itself, the presence of a union 
added an additional layer of complexity. But, you know, I am glad 
to report that we have developed a very strong relationship with 
our bargaining unit and that 

Mr. Cassidy. But no one has been released, and it is so clear 
throughout here that there was a problem with — it was a problem 
not just of form but also of who was hired. That tells me, you guys, 
your credibility, frankly, is a little weak. I apologize. 

But here, for example — again, I am reading from your internal 
document — a large number of inspectors, quote, “were hired who 
have unrealistic expectations and the wrong skill set or mindset to 
do the work of a regulatory inspector; who are located in geo- 
graphic areas that do not make sense or aligned to the mission; 
who, for example, seek law enforcement authority as opposed to 
work, using the uniform as a symbol of identity and authority rath- 
er than a tool to be used.” 

I mean, that suggests to me that it wasn’t just a tweaking, a lit- 
tle improvement of the bonding with the union, but there were peo- 
ple hired who were inappropriate to the position to which they 
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were hired. I can give further examples of that. The fact that you 
tell me that, no, we haven’t really released anybody, we have just 
reassigned them, tells me you haven’t been serious about what you 
are doing. 

Mr. WULF. I think we have come a long way in building the cul- 
ture of the organization and building the regulatory compliance or- 
ganization. And we have, you know, some very professional, ex- 
traordinarily talented folks throughout our team. They come from 
a variety of backgrounds 

Mr. Cassidy. OK. So, “some” — this is plural — “some are simply 
unsuited for supervision, treating employees in an unfair, unpro- 
fessional, or disrespectful manner. Others are uninformed about 
their responsibilities as a supervisor to manage employee issues.” 

This is your internal document. And yet what I am hearing from 
you is, no, we haven’t really released anybody, but we are working 
on it. Frankly, that doesn’t help your credibility. 

Mr. Beers. Sir, some of the thoughts behind that statement were 
that individuals were hired into positions that they weren’t ade- 
quately trained and, from a baseline resume review, didn’t have 
the background for. 

Mr. Cassidy. I am out of time 

Mr. Beers. What we have done is go through the process of 
training, go through the process of moving those individuals to 
more appropriate positions that are cast against their qualifica- 
tions. 

Mr. Cassidy. Has anybody had a reduction in pay? Because an- 
other thing was, “An excess number of highly graded personnel are 
serving in positions that do not contribute to the mission at a level 
commensurate with their pay grades.” Has anybody taken a de- 
crease in pay? 

Mr. Beers. That is where I say we are moving people to more 
appropriate positions. 

But let me ask David to clarify. 

Mr. WuLF. And we have made a lot of process over the past year. 
I mean, that report was put together about a year ago, and we 
have put into place a variety of things, including training for super- 
visors. We have 

Mr. Cassidy. If I am a taxpayer and if I see something that 
smacks of cronyism, per your report, the obvious question is, am 
I getting more bang for my taxpayer buck? 

Has anybody taken a cut in pay? 

Mr. WuLF. We have people in positions for which they are more 
suited. And we have put into place, you know, an open and trans- 
parent process. 

Mr. Cassidy. I will take that as a “no.” We are out of time. I 
apologize. 

Mr. Shimkus. The gentleman is yielding back his time. 

I guess the big point is, if you can’t do the small things, how can 
the country, the localities, the taxpayers, the public interest 
groups, expect us to do the big things? And that line of questioning, 
I think, just highlights that. 

The chair wants to announce that he wishes to recess this hear- 
ing so Members and interested persons can go to the 9/11 service 
at the Capitol. 
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With no objection, Mr. Beers is excused from the first panel. 

Mr. Beers, will you commit to provide full and accurate responses 
to written questions within 10 days of their submission? 

Mr. Beers. Yes, sir. 

Mr. Shimkus. And that is a request from both sides. 

When we return, we will have Mr. Wulf and Ms. Berrick con- 
tinue answering some questions, if that is OK with you all. 

The committee stands in recess until 11:45. 

[Recess.] 

Mr. Shimkus. I would like to call the hearing back to order. 

Again, we want to thank you for your patience and for giving us 
an opportunity to join our colleagues out on the east steps of the 
Capitol. It is always a memorable time and usually very short be- 
cause on September 11th, that it was a short event in which we 
gathered. So I think those of us who were here remember that with 
a lot of emotions, as Americans do. And that is why I think what 
we are doing here today is still important and relevant. 

So, with that, I would like to recognize myself, which would be 
a second round of questions, for 5 minutes. 

Ms. Berrick, CBS originally reported on problems with the 
CFATS program. The report showed a video clip of the Under Sec- 
retary of the National Protection and Programs Directorate, during 
which he called the CFATS program a “tremendous success to 
date.” 

Would GAO characterize the program the same way? 

Ms. Berrick. No, Mr. Chairman, not based on the work we have 
done to date. 

And I think what is going to dictate whether or not it is success- 
ful is whether it is able to execute its mission. And I think they 
are still in the early phases of positioning themselves to be able to 
do that. 

Mr. Shimkus. And, following up on your response, should they 
still be in the early stages? 

Ms. Berrick. You know, comparing them to other regulatory pro- 
grams across DHS, I think it is certainly taking them longer to get 
CFATS up and running. For example, comparing them to the Coast 
Guard, who also had to set up a regulatory regime at the ports 
when the Maritime and Transportation Security Act was passed, 
the Coast Guard got it up and running probably in a year and a 
half, although the Coast Guard did have personnel in place and an 
infrastructure, so they were better equipped to get up to speed ear- 
lier. 

TSA may be a better comparison since that was a new organiza- 
tion and they were setting up a new regulatory regime. It took 
TSA, I think, several years, looking across both their regulatory 
and voluntary programs, and they also had some challenges but 
not to the degree that CFATS has had. 

I think part of this could also be contributed to the standards 
that inspectors are assessing against. And CFATS is performance- 
based, which are broader, whereas at TSA the standards tended to 
be more specific, and that could be, in some respects, easier to es- 
tablish a framework to assess against those specific standards. 

So some differences, but looking across the Department, it has 
taken CFATS longer to get up and running. 
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Mr. Shimkus. Well, I think it was last year when I had an in- 
spector just come visit and kind of do an open-office-hour type of 
thing. And he was well-intentioned, wanted to do the right thing, 
but really was really lacking any guidance. So I think they were 
going around visiting facilities but really having no idea what they 
were checking for and why they were checking for it. And it kind 
of saddened me just because he really wanted to do the right thing 
but there was really a lack of guidance. And this was last year, last 
August, so not this past August. 

I understand that GAO has placed DHS on its high-risk list due 
to management challenges facing the Department. And we are 
talking about the whole Department of Homeland Security. To 
what extent have these management challenges had an impact on 
the NPPD’s ability to manage the CFATS program? 

Ms. Derrick. You know, I think CFATS is an example of those 
management challenges that we talk about in the high-risk area. 

We placed DHS on the high-risk list in 2003 after it was created 
because we found that they didn’t have the rigor and procedures 
and oversight over their core management functions, and this is ac- 
quisition management, financial management, information tech- 
nology, and human capital management. 

And what we were finding is, because of not having the discipline 
in these management areas, it was having a negative effect on 
DHS’s ability to implement its mission. So there were a number of 
programs that weren’t meeting performance expectations, cost 
more than what they were supposed to cost, were taking longer to 
field, because of these management challenges. 

I think CFATS is an example of this. For example, in the human 
capital area, we have talked throughout the Department about 
DHS’s challenges and bringing people with the needed skills and 
abilities on board to fill critical positions. They have had challenges 
in doing that. 

In the information technology area, you know, CFATS has an in- 
formation technology tool to solicit input from the facilities to look 
at their site security plans and vulnerability assessments. The tool 
has some challenges, which were identified in the internal memo, 
mainly that it provides a lot of data but not in a real user-friendly 
format to read. So that is an example of an IT challenge. 

I think the Department as a whole has recognized these manage- 
ment problems. They have some good strategies in place to address 
them, but they are in the relatively early stages of doing that. 

Mr. Shimkus. So DHS is in the high-risk; CFATS is probably 
their number-one problem of concern. I think it goes back to the 
issue of, if you can’t get the small things right, how do people trust 
you to do the big things in this issue? So we appreciate your anal- 
ysis. 

And my final question: Given the seriousness and multitude of 
problems CFATS is facing, particularly with respect to conducting 
its mission, would it be viable to consider, quote/unquote, “standing 
down” the program for some period of time so that these issues can 
be addressed before attempting to move forward with this regu- 
latory mission? 

And to put it in another way, it is like trying to build a car while 
you are racing the car. 
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Ms. Berrick. Right. 

Mr. Shimkus. Could we get a better return on investment and 
a more timely process getting it right before it deployed? Do you 
understand the question? 

Ms. Berrick. Yes, I do. Thank you Mr. Chairman. 

You know, I think that is something DHS would have to con- 
sider, weighing that against the need to field a program to address 
existing security vulnerabilities. 

You know, there is an example in DHS’s history where they did 
just that. They were working to field a program called Secure 
Flight, which was a high-priority program within the Department 
that compared the matching of passenger information against ter- 
rorist watch lists for airline passengers. Air carriers used to have 
that function. The 9/11 Commission recommended that DHS take 
over that function from carriers. 

Well, DHS tried to field this program for several years. Five 
years into it, they weren’t able to field a successful program, and 
so they did just what you mentioned. They actually stood down the 
program. They went back and instilled some rigor in the acquisi- 
tion that wasn’t there before. They were making sure that they 
were preparing appropriate documentation. And they did that for 
a year. And then when they turned the switch on and moved for- 
ward, they ended up fielding a successful program. 

So even though there was a delay when they did stand down the 
program, ultimately they probably saved time, in that they were 
able to address those problems they had, finish that, and then 
focus on implementing the program. So I think it is something 
worth thinking about. 

Mr. Shimkus. Time, effort, energy, frustration, all of the above. 
And I would agree, I think I am going through the secure TSA 
thing now. It just popped up; I wasn’t given much warning. And 
all of a sudden, I can go in a different lane. So it is pretty nice. 

The chair now recognizes the ranking member, Mr. Green, for 5 
minutes. 

Mr. Green. Thank you, Mr. Chairman. 

In June of this year, the House passed an appropriations bill for 
the Department of Homeland Security that cut funding for CFATS 
in half. 

Mr. Wulf, what impact would cutting your budget in half, on the 
CFATS program, what impact would it have? 

Mr. Wulf. That proposed cut would have a pretty major impact 
on our ability to move the program forward at, you know, what is 
really a critical time for the program. 

You know, we have made a great deal of progress in our action 
plan. You know, we have, in essence, taken a bit of an operational 
pause over the past several months. We are now at the point where 
we have conducted the training. We have developed a streamlined 
site security plan review process. We have our inspectors out, hav- 
ing recommenced authorization inspections. We have turned an im- 
portant corner in the program. And a cut, as the House Appropria- 
tions Committee has proposed, would force some very, very difficult 
choices. 

We would have a limited ability to pursue needed improvements 
to the site security plan tool and the Top-Screen and SVA tool. 



52 


something we are moving forward with in partnership with our in- 
dustry stakeholders. We would have limited ability to continue im- 
plementing the action plan. We have made a considerable amount 
of progress in that implementation process, having completed 67 of 
the 95 action items. 

It would essentially cut the legs out from under us when we have 
turned an important corner, when we do expect and anticipate and 
have already begun to see a heightened pace of site security plan 
authorizations, approvals, and facility inspections. 

Mr. Green. Well, and I am sure you understand the frustration 
after 6 years and funding and funding and that frustration. But we 
are seeing some improvement now, and to cut the funding and still 
expect results is just not going to happen. And so I don’t know 
what the continuing resolution we will vote on this week has for 
the 6 months, but I would hope it would be something that would 
give you the resources to do your job. 

Mr. Wulf, the site security plan process is a key link to your abil- 
ity to effectively review and approve plans. Have you made 
progress with improving this vital tool so that the covered facilities 
have clear instruction on information DHS needs? 

Mr. Wulf. Yes, we have, in fact. We, over the past several 
months, having learned many lessons ourselves as we went 
through the site security plan reviews at our headquarters, have 
been out kind of piggybacking on events that industry associations 
have been holding across the country, to get the word out to facili- 
ties about how they can provide the detail that will enable us to 
get more efficiently and effectively through the review of the site 
security plans and get to authorization and approval in a more 
streamlined fashion. 

You know, at the same time, we are kicking off the SSP tool 
focus groups, working groups, with industry to continue to try to 
improve that tool to make it more user-friendly, both to the facili- 
ties and to our reviewers, and also continuing to work with indus- 
try on the alternative security program templates. 

Mr. Green. Well, I am glad you are bringing in the regulated 
community because, again, I have huge numbers of those in our 
district. And we have a particular group that I work with a lot, the 
East Harris County Manufacturers, made up of oil refiners, chem- 
ical plants, service companies. And that is one of the issues, when 
I talk to them, that they want to be part of the solution instead 
of just being told what to do. And sometimes the Federal Govern- 
ment is known for giving instructions that don’t work on the 
ground. 

Mr. Wulf. Yes. 

Mr. Green. And so I am glad you are bringing them in. 

Ms. Berrick, the GAO has done extensive work on the need for 
strong security at chemical facilities going back as far as 2003. Can 
you describe the risk posed by these facilities? 

Ms. Berrick. There is a risk posed by these facilities, the details 
of which are classified. We will be happy to come up and brief you 
and your staff separately on that. But there is a risk, according to 
DHS’s threat assessment. 

Mr. Green. I have no doubt that there is a risk. In fact, I have 
companies that produce ammonia, that we ship ammonia, all sorts 
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of volatile chemicals. That is just the nature of our district. It is 
important to have an effective government program, though, that 
ensures chemical facilities are protected from a terrorist attack. Is 
that correct? 

Ms. Berrick. According to DHS’s threat assessments, they have 
identified a need for such a program. 

Mr. Green. And, you know, there are things that are happening 
in the last 6 years, even though the oversight may not be there, 
or what we need. Because I know, both through the FBI working 
with local law enforcement and our plant security, I have seen 
them there, our local special agent in charge has told me they have 
been on every plant site, in fact, probably, by now, a number of 
times, to be able to work with the folks who actually work there 
and produce these products that our country needs. 

Mr. Chairman, I know I am over time, so thank you. 

Mr. Shimkus. The gentleman yields back his time. 

The chair now recognizes the gentleman from Louisiana, Mr. 
Cassidy, 5 minutes. 

Mr. Cassidy. Mr. Wulf, again, I am a physician. I know if you 
continue to have the same inputs, you should expect the same out- 
put. So all my questions go back to that initial report as to the in- 
puts of your process, which obviously have been lacking. 

And, by the way, when you haven’t laid off anybody and yet we 
have an internal report showing that some of the people are sitting 
at their desk are doing nothing, but you continue to maintain you 
need the same amount of money, I am wondering why we are giv- 
ing you any because, frankly, the public trust is not being met by 
your actions. That is just my perspective and as a counterpoint to 
what Mr. Green said. 

Ms. Berrick, in the internal report, it said that the database 
CHEMS was the wrong database. “It does appear the database can 
be modified to meet needs but requires a substantial amount of re- 
defining requirements, reworking protocols, codes, et cetera, calling 
into question the funding spent to date,” going back to funding. 

Is the database now adequate? 

Ms. Berrick. It is not, according to the office and based on the 
work we have done to date. 

It does provide some value because it is a tool to collect the need- 
ed information for CFATS to assess. However, it is not very user- 
friendly. Outputs are oftentimes data dumps that are difficult to 
sift through, especially when you are looking at something as com- 
plex as what CFATS is looking at. 

So there are identified challenges that CFATS has identified 
themselves and are working to try to address, but it is going to 
take time and money to, I think, make those revisions to the sys- 
tem. 

Mr. Cassidy. OK. Time and money to make that revision, and 
yet somehow we are going to be back on track certifying plants. 
And I don’t want this to be mean, but I am supposed to be pro- 
viding oversight for the American taxpayer, who, if she knew what 
was going on, would just be furious. 

Ms. Berrick, it said in the internal report that ISCD does not 
have an established records management system to document, de- 
velopment, and maintenance of necessary historical documentation 
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related to programs owned by the division. Has that now been cor- 
rected? 

Ms. Berrick. I don’t know if that has been a closed action item 
or not. I believe it is in progress. Maybe Mr. Wulf has the current 
status. 

Mr. Wulf. Yes, it is in progress. And we are keeping records 
very, very extensively and thoroughly. It is a high priority and 
something we take very seriously, as the remainder of the action 
items, as well, on which we have made a significant amount of 
progress on. 

Mr. Cassidy. So, yes or no, do you have an established records 
management system now? 

Mr. Wulf. We do. 

Ms. Berrick. If I could mention, Mr. Cassidy, GAO has ongoing 
work looking in more detail at CFATS’ ability to meet its mission. 
We will be reporting on those results early next year, including 
looking at the records retention issue. 

Mr. Cassidy. OK. That would be great. 

Budget: Our lack of focus and vision has resulted in problems, 
how we spend our money, how we are managing these funds — for 
example, buying first responder equipment such as hazmat suits 
when, as a regulatory entity, we do not have a first-responder role. 

Ms. Berrick, has that been corrected? 

Ms. Berrick. I do not know, Mr. Cassidy. 

Mr. Cassidy. Mr. Wulf? 

Mr. Wulf. Yes, it absolutely has. In the early days of the pro- 
gram, there were course corrections. There was some thought — and 
this was before my time — that the chemical security inspectors 
would have a response role. As the program evolved and as it be- 
came clear that they would not, that equipment was repurposed 
within the Department. 

Mr. Cassidy. Are we still paying more than $20,000 per year for 
professional memberships in ASIS that are unnecessary, et cetera? 

Mr. Wulf. We are not paying for those memberships anymore. 

Mr. Cassidy. And now, it says, ISCD lacks — again, internal docu- 
ment — lacks a system for tracking the usage of consumable sup- 
plies, which creates an environment for fraud, waste, and abuse to 
exist. 

Has that, Ms. Berrick, now been established? 

Ms. Berrick. I am sorry, I don’t know the current status of that 
item. 

Mr. Cassidy. Mr. Wulf? 

Mr. Wulf. Yes, we are track tracking those supplies. 

Mr. Cassidy. OK. 

Now, I could go on, but I think we are making the point. There 
seems to be substantial amounts of really critical things which 
have to be addressed. And in an ongoing basis, we are keeping peo- 
ple employed who, again, your internal documentation suggests are 
the inappropriate person for their roles. 

Build a case why we should give you more money. 

Mr. Wulf. Well, as I have said, we have made a significance 
amount of progress. I think with regard to 

Mr. Cassidy. Now, I am a physician, and I teach. So when a 
medical student — and I say this not to be abusive, and I apologize 
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if I come across this way. But if somebody tells me “significant” — 
“significant” is one of those loosey-goosey words that may or may 
not have significance. 

It certainly would move the ball from here to there, but if this 
is threshold at which you can actually accomplish a mission — 
where are you relative to getting to the threshold where you can 
actually accomplish your mission? Sure, you may have made sig- 
nificant progress, but you may have this incredible gap between 
where you are now and the threshold at which you can actually ac- 
complish your mission. 

Actually, Ms. Berrick, where would you guess they are? 

Ms. Berrick. I think they are in their early stages. They are still 
setting up a framework to position themselves 

Mr. Cassidy. Are we 10 percent of the way there? A hundred 
percent? Fifty percent? Sixty percent? 

Ms. Berrick. If I had to put a guess, an educated guess percent- 
age, you know, maybe 25 percent. 

Mr. Cassidy. Can you give us a timeframe in terms of years at 
which they will reach the threshold of being able to accomplish 
their mission? 

Ms. Berrick. You know, all the actions under way have different 
timelines. We have been told that it — CFATS is estimating it could 
up take up to 3 years to complete compliance inspections once they 
review the site security plans. 

Mr. Cassidy. But we don’t even have a database yet which can 
be easily used in order to support that initial site — so the 3 years 
was after the threshold is met? 

Ms. Berrick. Three years from today is the estimate that they 
provided us. And, again, we are going to continue to review this as 
a part of our ongoing work. And I think early next year we will be 
positioned to provide you details on where we think they are in 
terms of this continuum of progress. 

Mr. Cassidy. OK. Thank you. 

I yield back. 

Mr. Shimkus. Mr. Wulf, do you want to respond? 

Mr. Wulf. Yes, I mean, I would love to. 

We are, I believe, accomplishing our mission. The CFATS pro- 
gram has accomplished a great deal over the course of its existence. 
You know, the 2,700 facilities that have removed or reduced their 
chemicals of interest; you know, the 7,800 security vulnerability as- 
sessments that have been completed and reviewed by our staff; the 
more than 3,000 compliance assistance visits and other outreach 
visits that our inspectors have conducted have laid important 
groundwork. 

We are at the point where we are seeing a heightened pace of 
reviews of site security plans. Within the last week, we have au- 
thorized, myself along with Assistant Secretary Durkovich, have 
authorized 10 additional plans and approved our first 2 site secu- 
rity plans. 

We are going to be moving this program forward. And, you know, 
I am very pleased to say that, you know, I have had, as have the 
rest of our team in ISCD, a tremendous amount of support within 
the organization. There is a tremendous amount of commitment for 
getting this job done. 
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We are accomplishing the mission. In terms of percentages, we 
put into place that corrective action plan last fall; we are 70 per- 
cent done with that. You know, not that we are ever going to be 
completely done. We are going to continue forward — I am sorry, sir. 

Mr. Shimkus. I appreciate your passion in defending the pro- 
gram. You can understand why my colleague, his frustration. 

Mr. WULF. Sure. 

Mr. Shimkus. And we all want to move this together. 

In talking with my ranking member, two things: He wants to 
make sure we put on record that, obviously, our oversight is not 
going to end, so we will just keep monitoring this. And I think for 
both of us, for the defense of the program, and for the giving due 
preference and diligence to our taxpayers, I think it is the right 
course of action, to make sure that we finish this and we have a 
program that we can defend publicly. 

Also, without objection, I would like to pose one other question, 
just because we were talking about budgets. The President is sup- 
posed to lay out, hopefully, sequestration issues Friday. Sequestra- 
tion, 50 percent of that comes out of defense and homeland secu- 
rity, national defense issues. 

Have you all heard — and I know that you have a small program 
within Homeland Security. But I would venture to say that what- 
ever budget that the House has proposed that might address fund- 
ing, sequestration might do even more. 

Have you guys even talked about what effect sequestration might 
have to the CFATS program? 

Mr. WuLF. I have not been part of those discussions. 

Mr. Shimkus. And we await the President’s disclosing what he 
may or may not do. 

Seeing no other Members asking for time, we would like to thank 
you for coming back, making sure that we could get the second 
round. It was very important for all of us. And we would like to 
dismiss you and empanel the second panel. So, with that, thank 
you very much. 

Mr. WULF. Thank you. 

Mr. Shimkus. We also want to thank you all for coming. 

The way I operate is I am going to introduce you all, like, right 
off the bat, and then we will go for 5-minute opening statements. 

We also ask unanimous consent that all members of the sub- 
committee have 5 days to forward questions to you all, too. And, 
without objection, so ordered. 

On the second panel, we have Mr. Timothy Scott, chief security 
officer of Dow Chemical Company. We also have Mr. Matthew 
Leary, corporate EHS&S manager. Pilot Chemical Company. We 
have Ms. Anna Fendley, United Steelworkers, Health, Safety, and 
Environment Department; and Mr. Paul Orum on his own behalf. 

So, with that, we appreciate you attending. You all have 5 min- 
utes for an opening statement. Your full statement will be sub- 
mitted for the record. I did review them, scanned them, all last 
night. And so I appreciate the efforts you made on that behalf 

And, with that, we will begin with Mr. Scott for 5 minutes. 
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STATEMENTS OF TIMOTHY J. SCOTT, CHIEF SECURITY OFFI- 
CER AND CORPORATE DIRECTOR, EMERGENCY SERVICES 
AND SECURITY, THE DOW CHEMICAL COMPANY; MATTHEW 
J. LEARY, CORPORATE EHS&S MANAGER, PILOT CHEMICAL 
COMPANY; ANNA FENDLEY, HEALTH, SAFETY, AND ENVI- 
RONMENT DEPARTMENT, UNITED STEELWORKERS; AND 
PAUL DRUM, BLUE GREEN CHEMICAL SECURITY COALI- 
TION, INDEPENDENT CONSULTANT TO THE CENTER FOR 
AMERICAN PROGRESS 

STATEMENT OF TIMOTHY J. SCOTT 

Mr. Scott. Chairman Shimkus, Ranking Member Green, and 
members of the subcommittee, my name is Tim Scott, and I am the 
chief security officer for The Dow Chemical Company. I am speak- 
ing today on behalf of Dow and the American Chemical Council, 
and I will focus on four points. 

First, the chemical industry and DHS have a common goal of im- 
proving the security profile of the chemical sector, reducing the risk 
of attack or the use of chemicals as a weapon, and minimizing the 
impact of the potential threats on our country. 

Second, the chemical industry and DHS have made some 
progress using both voluntary industry initiatives and collaborative 
efforts to clarify and meet performance standards. 

Third, the concerns associated with the implementation of the 
Chemical Facilities Anti-Terrorism Standards and internal DHS 
management issues are real. It is promising to hear that improve- 
ments are being made in both areas. In spite of these distractions, 
industry has made progress. 

And, lastly, we need to build on this progress to achieve an effi- 
cient, integrated, and sustainable security plan for the chemical in- 
dustry and our country. It is time to move on and, in fact, accel- 
erate our efforts. 

The CFATS concept is fundamentally sound. DHS established 
Risk-Based Performance Standards, flexibility for the regulated 
companies to apply customized security solutions for each unique 
site and situation, and DHS final approval and review for compli- 
ance. That is the goal: to set expectations, meet those standards, 
and, by doing so, reduce the vulnerability and risk of our chemical 
sector. 

Too often, we fixate on the methods used to achieve the goal in- 
stead of the goal itself No one method addresses every site or 
every situation, but we are making progress. 

The concept of alternative security plans offer an excellent oppor- 
tunity for a thorough but expeditious review and approval process 
of the site security plans at many CFATS-regulated facilities, espe- 
cially those in the lower-tiered sites and companies that have mul- 
tiple regulated sites. 

DHS recently completed a pilot test of an ACC-developed alter- 
native security plan, and it proved to be a worthwhile exercise for 
both industry and DHS — an excellent example of an open and col- 
laborative effort to improve and expedite the process. Members of 
the ACC implemented the Responsible Care Security Code in 2002. 
And over the past decade, ACC members have spent nearly $10 bil- 
lion on security enhancements. 
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The code is a requirement for membership and is included in 
independent, third-party audits of the Responsible Care Manage- 
ment System. Recognition of the value of such voluntary industry 
initiatives is being considered as another possible means of fast- 
tracking reviews of site security plans. 

The next generation of the DHS site security plan tool is being 
developed and will be both easier and more efficient for industry 
and a more valuable and usable source of information for DHS. 
Progress has been made, but there are still some hurdles to over- 
come. 

Personnel surety is critical to any security program, and most 
companies had background checks and programs in place well be- 
fore the creation of DHS. Screening against the terrorist database 
is a welcome addition to the performance standards and is, as it 
should be, a government responsibility. 

CFATS is closing this gap, but this is an area where we can use 
your help. By design, CFATS allows the flexibility to address each 
performance standard using the method best suited to each par- 
ticular site and situation. The personnel surety program and per- 
formance standards should be no exception. 

There are many readily available government-approved options 
that would fully comply with this standard, and there is no valid 
reason to limit the options. In the case of the personnel surety 
standard, however, DHS management has not demonstrated the 
flexibility that is integral to and authorized by CFATS. 

Also in the area of the terrorist database screening, there is one 
concept in which all security managers agree: We should know that 
a person can pass this screening before we issue an entry card and 
let a potential threat in the gate. And we should keep any potential 
threat out of the site. That is a pretty basic security concept, but 
it is not clear that DHS management is in agreement with this im- 
portant point, and that is a cause for significant concern. 

There is definitely room for improvement in the implementation 
of the Chemical Facilities Anti-Terrorism Standards, but the nec- 
essary corrections can be made and success can be achieved. Suc- 
cess demands constancy of purpose, commitment, and collaboration. 
ACC member companies are committed. We should not return to 
square one with DHS or change course in midstream. We should 
strengthen collaboration and increase the pace to build an efficient, 
integrated, and sustainable chemical security process for our coun- 
try. 

Thank you. 

Mr. Shimkus. Thank you, sir. 

[The prepared statement of Mr. Scott follows:] 
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chairman Shimkus, Ranking Member Green and members of the subcommittee, my name is 
Tim Scott and Tm the Chief Security Officer of The Dow Chemical Company. 


Tm speaking today on behalf of Dow and the American Chemistry Council, the nation's largest 
chemical industry trade representative. 

Ours is a robust and diverse industry - our nation's largest exporting sector, employing over 
three-quarters of a million people in the United States, and investing billions of dollars in the 
safety and security of our facilities. 

I'll focus on four points today: 

The chemical industry and Department of Homeland Security have a common goal of improving 
the security profile of the chemical sector, reducing the risk of attack against the industry or the 
use of chemicals as a weapon, and minimizing the impact of potential threats to our country. 

The chemical industry and DHS have made progress using both voluntary industry initiatives 
and collaborative efforts with DHS to clarify and meet performance standards. 

The concerns associated with the implementation of the Chemical Facilities Anti-Terrorism 
Standards and internal DHS management issues are real. It's promising to hear that progress is 
being made in both areas. In spite of these distractions the sector has made progress. 
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And lastly, we need to build on this progress -as respectful partners with a common goal - to 
achieve an efficient, integrated and sustainable security plan for the chemical industry and our 
country. 

It's time to move on - and in fact accelerate our efforts. 

The CFATS concept is fundamentally sound - risk-based and focused on the right priorities - 
allowing the regulated companies to apply customized security solutions to each unique site 
and situation for DHS review and approval for compliance with the DHS-established risk-based 
performance standards. 

THAT is the goal - to meet the standards and by doing so reduce the vulnerability and risk of 
our chemical sector. Too often we fixate on the methods used to achieve the goal instead of 
the goal itself. No one method, no single silver bullet addresses every site or every situation. 
The path to success can - and usually does - vary with every site or situation. 

We are making progress; 

The concept of alternative security plans that would expedite the review and approval process 
- especially for lower tiered sites and companies that have multiple regulated sites - is being 
tested. DHS recently completed a pilot test of an ACC-developed alternative security plan, and 
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it proved to be a worthwhile exercise for both industry and DHS -- an excellent example of an 
open and collaborative effort to improve and expedite the process. 

Members of the American Chemistry Council implemented the Responsible Care Security Code 
in 2002 and over the past decade ACC members have spent nearly 10 billion dollars on security 
enhancements. The Code is a requirement for membership and is included in independent 
third party audits of the Responsible Care Management System. Recognition of the value of 
industry initiatives is being considered as another possible means of fast tracking reviews of site 
security plans. 

Both examples offer an excellent opportunity for a thorough but expeditious review and 
approval process of the site security plans at CFATS-regulated facilities. 

The next generation of the site security plan tool is close to launch, and is both easier and more 
efficient for the industry and a more valuable and useable source of information for DHS. 

Progress has been made, but there are still some hurdles to overcome. 

Personnel Surety is critical to any security management program. Most companies had robust 
background check programs in place well before the creation of the DHS. Screening against the 
Terrorist Database is a welcome addition to the performance standards, and is - as it should be 


4 



63 


- a government responsibility. CFATS is closing this gap but this is an area where we can use 
your help. 

By design CFATS allows the flexibility to address each performance standard using the method 
best suited to each particular site and situation. The personnel surety performance standard is 
no exception. As with all the risk-based performance standards there are many ways to comply 
with this requirement. There is no valid reason to limit the options when many readily- 
available options would meet the performance standard. In the case of the personnel surety 
program DHS has not demonstrated the flexibility that is integral to and authorized by CFATS. 

In the discussion of TDB screening there is one area in which all security managers agree - we 
should know that a person can pass the TDB screening BEFORE we issue an entry card and let a 
potential threat in the gate -- and we should keep any potential threat out of the site. It is not 
clear that DHS management is in agreement with this important point, and that is a cause for 
concern. 

Industry and DHS - have made progress in improving the security of the chemical sector. There 
have been missteps, but we can make the necessary corrections and achieve successful results. 
It takes commitment and collaboration. ACC member companies are committed. 

We should not return to square one with DHS or change course in mid-stream. Instead we 
should strengthen the collaboration between DHS and industry with the unified goal of 
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increasing the pace to build an efficient, integrated and sustainable chemical security process 
for our country. 

Thank you. 
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Mr. Shimkus. I would now like to recognize Mr. Leary for 5 min- 
utes. 


STATEMENT OF MATT H EW J. LEARY 

Mr. Leary. Good afternoon, Chairman Shimkus, Ranking Mem- 
ber Green, and members of the subcommittee. My name is Matt 
Leary, and I am both corporate security officer as well as the envi- 
ronment, health, and safety manager for Pilot Chemical Company 
in Cincinnati, Ohio. 

I am pleased to provide this testimony on behalf of the Society 
of Chemical Manufacturers and Affiliates regarding how the De- 
partment of Homeland Security has been implementing the Chem- 
ical Facility Anti-Terrorism Standards and what that has meant 
for Pilot’s two covered facilities. 

Pilot Chemical is a small, privately held company celebrating its 
60th anniversary on the 19th of this month. We specialize in 
alkylation, sulfonation, and sulfation, which are used to manufac- 
ture detergents. We have only 200 employees. We have four facili- 
ties, two of which are subject to CFATS. 

Maintaining the security of our facilities has always been a pri- 
ority for SOCMA members like Pilot. After the tragic events of 9/ 
11, which occurred 11 years ago today, SOCMA members did not 
wait for new government regulations before researching, investing 
in, and implementing additional and far-reaching facilities security 
measures to address these new threats. However, there were no 
uniform Federal standards for measuring and implementing these 
security improvements across industry. CFATS standardized that 
process. 

Definitively, DHS’s Chemical Facility Anti-Terrorism Standards 
work. DHS listened to the private sector in developing a regulatory 
framework that is risk-based and preserves the ability for security 
professionals to make investments in measures that suit their spe- 
cific facilities but that also provides robust performance standards 
and imposes strict penalties for noncompliance. 

But that does not mean that the CFATS experience has been 
easy for regulated companies, especially small ones like Pilot. 

In several respects, the manner in which DHS has implemented 
the regulations has imposed substantial uncertainties and costs on 
companies. I recognize that DHS has been building out the pro- 
gram at the very same time it has been implementing it. Nonethe- 
less, I am confident that DHS could have substantially reduced 
these uncertainties and costs if they had implemented the program 
more quickly and confidently. They still could. 

An ongoing challenge for Pilot has been the unwillingness of 
DHS to give us useful guidance on how to comply with the risk- 
based performance standards that are at the heart of CFATS. DHS 
staff said they cannot give us clear guidance because the CFATS 
statute prohibits DHS from requiring facilities to implement spe- 
cific security measures. 

That is ridiculous, however. The statute’s prohibition on requir- 
ing particular security measures doesn’t prevent DHS staff from 
saying security measure X is one way to meet KBPS Y at tier level 
Z. It is not the only way, and we are certainly open to discussing 
other ways. 
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If DHS staff were willing to offer nonexclusive safe harbors to 
those seeking feedback, companies like Pilot that are looking for 
clear compliance guidelines would be able to obtain it. 

The other reason we believe DHS has been unwilling to give 
clear guidance is described on page 10 of the Anderson-Wulf memo, 
which says, “There exists within the cadre of SSP reviewers a re- 
luctance to recommend good enough SSPs for authorization or con- 
ditional authorization out of fear that the leadership has a zero-tol- 
erance philosophy toward mistakes and out of a lack of clarity re- 
garding expectations.” 

DHS needs to make clear to staff that they are expected to use 
their judgment to make decisions and that management will not 
punish them for doing so. 

Another issue of concern to Pilot has been DHS’s misguided per- 
sonnel surety proposal. Last year, DHS announced its intent to es- 
tablish a Web-based application that would require facility owners 
and operators to submit personally identifying information about 
current and prospective employees, as well as contractor and vis- 
itor personnel seeking access to a plant. 

Our industry has expressed serious reservations about the 
logistical nightmares that this proposal could lead to, given the 
heavy presence of contractors at chemical sites, especially during 
plant-wide maintenance turnarounds. DHS has been open to dis- 
cussing alternative approaches, and the industry has proposed both 
interim and long-term alternatives that could involve reliance on 
existing Federal vetting programs, mechanisms by which con- 
tractor and visitor employees could submit information regarding 
their own employees, and ultimately a universal Federal security 
credential that would supersede all others. 

Many smaller companies like Pilot would benefit from leveraging 
existing processes for vetting individuals that we feel meet the in- 
tent of the standards. DHS’s prior proposal would unnecessarily 
limit the number of options open to regulated facilities for com- 
plying with KBPS 12 . Resolving this challenge expeditiously would 
free up ISCD resources to focus on the more pressing task of ap- 
proving SSPs and initiating compliance inspections. 

As I have testified today, the CFATS framework is sound, but 
DHS’s implementation has been flawed. We have seen progress 
made by the Department under the recent management of Deputy 
Under Secretary Suzanne Spaulding and ISCD Director David 
Wulf. To help ensure further progress is made, however, DHS must 
not drift away from the spirit of the public-private partnership on 
chemical security that it has so often hailed as the keystone of the 
CFATS program. 

I appreciate this opportunity to testify before you today and look 
forward to your questions. 

Mr. Shimkus. Thank you, sir. 

[The prepared statement of Mr. Leary follows:] 
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Good morning Chairman Shimkus, Ranking Member Green, and members of the Subcommittee. 
My name is Matt Leary and I am both Corporate Seeurity Officer as well as the Environment, 
Health, and Safety Manager for Pilot Chemical Company in Cincinnati, Ohio. I am pleased to 
provide this testimony on behalf of the Society of Chemical Manufacturers and Affiliates 
(SOCMA) regarding how the Department of Homeland Security (DHS) has been implementing 
the Chemical Facility Anti-Terrorism Standards (CFATS) and what that has meant for Pilot 
Chemical’s two covered facilities. 

Pilot Chemical is a small privately-held company, celebrating its 60* anniversary on the 1 9* of 
this month. We specialize in alkylation, sulfonation and sulfation, which are used to 
manufacture detergents. We have only 200 employees. We have 4 facilities, two of which are 
subject to CFATS. 

Pilot Chemical is in many ways typical of the members of the Society of Chemical 
Manufacturers and Affiliates, to which we are proud to belong. For 91 years, SOCMA has been 
and continues to be the leading trade association representing the batch, custom, and specialty 
chemical industry. SOCMA’s nearly 230 member companies employ more than 100,000 
workers across the country and produce some 50,000 products - valued at $60 billion annually - 
that make our standard of living possible. From pharmaceuticals to cosmetics, soaps to plastics 
and all manner of industrial and construction products, SOCMA members make materials that 
save lives, make our food supply safe and abundant, and enable the manufacture of literally 
thousands of other products. Over 80% of SOCMA’s active members are small businesses like 
Pilot Chemical. 

Maintaining the security of our facilities has always been a priority for SOCMA members, and 
was so before September 1 1 . After the tragic events of 9/1 1 , which occurred 1 1 years ago today, 
SOCMA members did not wait for new government regulations before researching, investing in 
and implementing additional and far-reaching facility security measures to address these new 
threats. Under SOCMA’s ChemStewards® initiative, SOCMA members were required to 
conduct security vulnerability assessments (SVAs) and to implement security measures. 
However, there were no uniform federal standards for measuring and implementing these 
security improvements across industry. CFATS standardized that security process. 

Many SOCMA member company facilities, just like Pilot Chemical’s, are encompassed within 
the CFATS program. They have submitted their Site Security Plans (SSPs) and - we assume - 
will eventually be inspected by DHS to verify the adequacy of those plans and their conformance 
to them. SOCMA members have spent billions of dollars and have devoted countless man-hours 
to secure their facilities and operations. These investments will naturally continue for the 
foreseeable future. SOCMA has tried to actively engage with DHS to accelerate and 
continuously improve the implementation of the CFATS program, exploring new approaches to 
personnel surety and Alternative Security Programs. 

Definitively, DHS’s Chemical Facility Anti-Terrorism Standards work . DHS listened to the 
private sector in developing a regulatory framework that is performance-based and preserves the 
ability for security professionals to make investments in measures that suit their specific 
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facilities, but that also provides robust performance standards and imposes strict penalties for 
non-compliance. 

But that does not mean that the CFATS experience has been easy for regulated companies, 
especially small ones like Pilot Chemical. In several respects, the way that DHS has 
implemented the CFATS regulations has imposed substantial uncertainties and costs on 
companies. I recognize that DHS has been building out the program at the very same time it has 
been implementing it. Nonetheless, 1 believe that DHS could have substantially reduced these 
uncertainties and costs if they had implemented the program more quickly and confidently. 

They still could. 

At the same time. Pilot Chemical along with SOCMA wants to recognize the marked 
improvement in CFATS implementation under the leadership of National Programs and 
Protection Directorate (NPPD) Deputy Undersecretary Suzanne Spaulding and Infrastructure 
Security Compliance Division (ISCD) Director David Wulf, both of whom joined the 
Department last year. We are confident that this program with continue to move forward with 
the both of them at the helm. 

Below I will (i) explain what is good about CFATS; (ii) describe the problems with its 
implementation and the impacts on smaller companies like Pilot Chemical; and (iii) describe 
some needed improvements. 

I. Despite Departmental Mismanagement, CFATS is Reducing Risk 

To be clear, SOCMA’s membership regards the program thus far as a success, even if its 
implementation has moved much more slowly and cautiously than we all would prefer. The 
CFATS statute was wisely drafted to be comprehensive and flexibly structured to impose 
security performance standards that are relatively more demanding of higher-risk facilities and 
less demanding of lower-risk plants. To a great extent, DHS’s rules implement the statutory 
mandate issued by Congress in 2006. 

Both the law and the rules are fundamentally sound and do not require replacement. Since the 
program was launched in 2007, more than 2,000 facilities have changed processes or inventories 
in ways that have enabled them to screen out of the program. Thus, as predicted, CFATS is 
driving facilities to reduce inherent hazards, where in their expert judgment doing so is in fact 
safer, does not transfer risk to some other point in the supply chain, and makes economic sense. 
Hundreds of other regulated facilities that had not already done so have already made significant 
proactive investments in security measures in anticipation of compliance with the full 
implementation of CFATS. As a result of CFATS, our nation is more secure from terrorist 
chemical attacks and other threats than it was before the program’s inception. And this risk 
reduction has taken place through a market-based approach that has certainly cost society less 
than if all the initially covered facilities were still subject to regulation. 


Furthermore, due to the outstanding cooperation of the chemical sector, there has been 100% 
compliance with the requirements to submit Top-Screens, SVAs and SSPs - DHS has not yet 
had to institute a single administrative penalty action to enforce compliance. 


3 



70 


SOCMA also supports the CFATS program because our members have invested significant 
amounts of financial and human capital in it over the past several years. Overall, covered 
facilities have invested billions of dollars in security upgrades to meet CFATS’s requirements - 
Pilot Chemical itself has invested hundreds of thousands of dollars. SOCMA’s members alone, a 
majority of which are small manufacturers with under $40 million in annual sales, have invested 
an estimated $5 1 5 million in security measures to date, CFATS has provided significant 
additional security to a critical segment of our nation’s infrastructure, as well as the general 
public. 

No one should dispute that, despite the challenges to its implementation, the two main 
alternatives to CFATS would both be far worse. Having no chemical security regulation at ail 
would create a risky and tilted playing field in which most companies secured their facilities 
voluntarily, at significant cost, while a minority created risks for us all, and gained an unfair 
economic advantage, by not doing so. Our nation would also not be well-served by a 
prescriptive program that mandated incorporation of inherently safer technology (1ST). Such an 
approach would threaten to drive chemical operations overseas where security standards are 
weaker. 

II. Small Businesses Suffer Disproportionately from DBS’s Problems Implementing 
CFATS 

A. The Impact of Delay on Budgeting, Investment and Staff Credibility 

As Corporate Security Officer for Pilot Chemical, 1 can tel! you that the most frustrating aspect 
of CFATS implementation has been not knowing, for years now, how much to budget for 
compliance. In this tough economy, every penny counts. Finance directors want to know when 
and how much our company will be spending on security measures to meet the requirements of 
CFATS compliance. Unfortunately, there is no way for me to answer either question. 

While security budgeting is an issue for any company whose site falls under CFATS, the 
challenges are especially great for small businesses like Pilot Chemical. We have limited capital 
to invest. Obviously, we would like to invest that money in plants and equipment so that we can 
take advantage of profitable business opportunities as they present themselves. We also have 
limited cash flow from operations, which we would like to be able spend buying raw materials 
and creating jobs. We recognize that we have to comply with CFATS, and we are prepared to do 
so, but we need to know how much it will cost and when those costs will be incurred. Instead, 
we have been forced to guess, and to hold the amount of projected early outlays in suspense, 
unavailable for productive purposes, in case DHS suddenly approves our SSP and we need to 
start incurring expenses to comply. You can, I hope, imagine our frustration as this situation 
persists, year after year, and we still have no idea when DHS will ever get to authorization 
inspections for our facilities’ tiers. That frustration is compounded as we relive the annual drama 
of whether Congress will extend the perennially expiring regulations for yet another year. 


We believe that our facilities are appropriately secure. But we have no real idea what DHS will 
conclude is required based on our submitted SSP, and companies the size of Pilot Chemical 
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cannot afford to guess. The biggest catastrophe for a small business is to hear something like: 
“The $250,000 you just shelled out for [fill in the blank] did not really help your profile and was 
in fact not needed.” As a result, we cannot spend dollars on security in advance unless we are 
clear that what is spent will directly lead to compliance with the standard. 

Besides tying up assets and preventing productive investments, the extended delays in 
implementation of CFATS also lead companies to question whether their government is really 
serious about the security of chemical facilities. While DHS expects regulated facilities to 
submit their SVAs and SSPs on time, commitments made about approving SSPs and completing 
pre-authorizing inspections by date X are repeatedly broken. Rarely are such exceptions made 
for industry. Such failures cause security professionals to lose credibility with their superiors 
who authorize compliance costs, as these managers conclude that their security staff are simply 
“crying wolf’ about their regulatory obligations. DHS mismanagement has, in some cases, 
stopped the momentum that security managers had with their own senior management in 
convincing them of the need for certain cost decisions, placing forward progress in a holding 
pattern. 


B. The Inability to Get Meaningful Guidance from DHS 

An ongoing challenge for Pilot Chemical, and for many other companies that have yet to see 
their SSP reviewed by DHS or that have had their submission rejected, has been the 
unwillingness of DHS to give us useful guidance on how to comply with the Risk-Based 
Performance Standards (RBPS) that are the heart of CFATS. When facilities ask headquarters or 
regional DHS staff whether particular security measures would satisfy a given standard for a 
given tier level, the staff routinely decline to give us a clear answer. We are only able to get non- 
specific comments that security professionals cannot translate into particular actions. 

DHS staff say they cannot give us clear guidance because the CFATS statute prohibits DHS 
from requiring facilities to implement specific security measures. That is ridiculous, however. 
The statute’s prohibition on requiring particular security measures doesn’t prevent DHS staff 
from saying “Security measure X is one way to meet RBPS Y at tier level Z. It is not the only 
way, and we are certainly open to discussing other ways.” The implementation of CFATS would 
be vastly improved if DHS staff were willing to offer non-exclusive safe harbors in this fashion. 
Then smaller companies like Pilot Chemical that are looking for clear compliance guidance 
would be able to obtain it, and larger companies would be free to design and propose their own 
solutions. 

1 agree it would be a problem if DHS regularly disapproved SSPs that included anything besides 
the example or safe harbor guidance. But the possibility that this might occur somewhere, 
sometime, is not a good reason to prohibit DHS staff across the board from offering safe harbors. 

The other reason we believe DHS has been unwilling to give clear guidance is described on page 
1 0 of the Anderson/Wulf memo, which says “there exists within the cadre of SSP reviewers a 
reluctance to recommend ‘good enough’ SSPs for authorization or conditional authorization out 
of fear that the leadership has a zero tolerance philosophy towards mistakes and out of a lack of 
clarity regarding expectations.” As DHS has testified today, only one SSP has been 
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conditionally approved to-date. DHS has obviously been letting the perfect be the enemy of the 
good. While SOCMA does not support a rushed process that accepts inadequate or incomplete 
SSPs, DHS needs to make clear to staff that they are expected to use their judgment and to make 
decisions - and that their management will not punish them for doing so. 

That said, despite the bad picture the Anderson/Wulf memorandum has painted of inspectors, 
they have always been available to SOCMA and its members, either providing compliance 
assistance on-site upon request or attending SOCMA events, and have been very engaging with 
our membership. 

C. Small Business Concerns with DBS’s Personnel Surety Program 

KBPS #12 requires facilities to implement security measures designed to: (i) verify and validate 
identity; (ii) check criminal history; (iii) verify and validate legal authorization to work; and (iv) 
identify people with terrorist ties. The facility is responsible for the first three tasks and for 
determining what criminal background findings would be disqualifying. Evaluating terrorist ties 
requires federal government involvement, however, in the form of evaluating names against the 
national Terrorist Screening Database (TSDB) maintained by the FBI. 

Last year, DHS announced its intent to establish a web-based application that would require 
facility owners and operators to submit personally-identifying information about current and 
prospective employees, as well as contractor and visitor personnel seeking access to a plant. 
Contrary to the flexible spirit of the CFATS program, this proposal would not grant companies 
the ability to decide how to vet personnel, such as accepting any of the half-dozen or so other 
federally-issued credentials that involve a TSDB check unless facilities gather additional 
information from persons presenting them. 

Our industry has expressed serious reservations about the logistical nightmares that this proposal 
could lead to, given the heavy presence of contractors at chemical sites, especially during plant- 
wide maintenance “turnarounds.” We have strongly urged DHS to accept other federally-issued 
credentials that involve a TSDB check without further collection of information. Unions have 
also expressed concern about DHS’s proposal. 

DHS has been open to discussing alternative approaches, and the industry has proposed both 
interim and long-term alternatives that could involve reliance on existing federal vetting 
programs, mechanisms by which contractor and visitor employers could submit information 
regarding their own employees, and ultimately a universal federal security credential that would 
supersede ail others. 

Many smaller companies like Pilot Chemical would benefit from leveraging existing processes 
for vetting individuals that we feel meet the intent of the standards. DHS’s prior proposal would 
unnecessarily limit the number of options open to regulated facilities for complying with RBPS 
# 12 . 

We have had productive discussions with the Office of Infrastructure Protection on our 
proposals, and DHS has accepted some of them (and backed off from some of its other 
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problematic proposals). DHS has also shown a good faith effort to engage industry since it 
withdrew its initial proposal in July from the Office of Management and Budget, which was 
reviewing it under the Paperwork Reduction Act. However, further progress has had to struggle 
against the desires of some within DHS to make CFATS a system for tracking which persons 
have ever had access to which chemical facility. 

Moving forward, I would emphasize that smaller companies have a seat at the table on personnel 
surety. 

Resolving this challenge expeditiously would free up ISCD resources to focus on the more 
pressing tasks of approving SSPs and initiating compliance inspections. 

D. Stalled Progress in Developing a Viable ASP 

The Alternative Security Program (ASP) originated under the Coast Guard’s Maritime 
Transportation Security Act (MTSA) program. The concept was to be a standardized plan 
designed for particular classes of facilities that would be more tailored to their circumstances and 
more flexible and open-ended option. 

DHS’s first mistake in this regard was in its Interim Final Rule, when DHS abandoned its 
original proposal and limited ASPs to individual facilities - so that DHS could not approve a 
single ASP for more than one facility.' This is one of the few areas where DHS could and 
should revise its CFATS regulations to make them better. 

As a result of DHS’s change, the option for facilities to submit an ASP has all but disappeared. 
Again, DHS has said that it wants to engage regulated facilities in developing more useful ASPs, 
but these discussions have not yet borne fruit. Many companies, including SOCMA members, 
have said that in order to produce an ASP template that satisfies DHS, they essentially need to 
replicate the SSP. For this reason, Pilot Chemical has chosen not to even attempt crafting an 
ASP. Until it revises its rules, DHS needs to be more open to models that are more like the 
security plans that companies actually use, and to approve generic or model ASPs that individual 
facilities could adopt for their own submissions. 

E. Delays in CSAT Tool Improvement 

The SSP tool was developed without sufficient input from industry. As a result, it is really a data 
collection tool, not a plan. A site security plan is an actionable document that tells managers 
what to do in a given circumstance. The CSAT SSP does not do this - you cannot manage with 
it. 

DHS has been working, on and off, for over a year on a “Gen 0” SSP. DHS should accelerate 
that work. They should actively engage the industry in that process and work closely together to 
produce a product that makes sense and meets the needs of both DHS and facilities. 


‘ Compare current 6 C.F.R. § 27.235 with the proposal (located at 71 Fed. Reg. 78298, Dec. 28, 2006). 
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III. DHS Must Improve Communication with the Regulated Community and Embrace 
Industry to Achieve Real Progress in Implementation 

As I have testified today, and as SOCMA has repeatedly testified before, the CFATS framework 
is sound, but DHS’s implementation has been flawed. This is largely because DHS has drifted 
away from the spirit of the public-private partnership on chemical security that it has so often 
hailed as a keystone of the CFATS program. Congress should encourage ISCD to work 
collaboratively with the regulated community to solve the technical, training and tool-related 
issues currently presenting challenges to the implementation of CFATS. Additionally, DHS 
must provide better guidance to the regulated community - particularly smaller companies 
without the benefit of a team of in-house experts or a budget that can accommodate outside 
consultants - on how to produce a SSP or ASP that meets the requirements of the KBPS. 

Industry can provide much assistance moving forward, including ways for DHS to minimize the 
future cost and complexity of the CFATS program. SOCMA believes that CFATS can 
successfully be implemented without the need for additional legislation. Success will require 
DHS to (i) give CFATS facilities regulatory certainty; (ii) make demonstrable progress 
reviewing and approving SSPs and inspecting facilities; and (iii) suitably engage industry in 
improving the CFATS program, especially as regards SSPs, ASPs and personnel surety. 
Congress can increase the chances of success by (i) conducting regular oversight, (ii) 
reauthorizing the statute for an extended period of time; and (iii) adequately funding the CFATS 
program. 

1 appreciate this opportunity to testify before you today and look forward to your questions. 
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Mr. Shimkus. The chair now recognizes Ms. Fendley for 5 min- 
utes. 


STATEMENT OF ANNA FENDLEY 

Ms. Fendley. Thank you. Chairman Shimkus, Ranking Member 
Green, and members of the committee, thank you for the oppor- 
tunity to be here today. 

I represent the Health, Safety, and Environment Department for 
the United Steel, Paper and Forestry, Rubber, Manufacturing, En- 
ergy, Allied Industrial, and Service Workers International Union — 
“USW” for short. We represent 850,000 workers in the sectors I 
just mentioned and many others, including the majority of union- 
ized workers in the chemical industry and hundreds of thousands 
of men and women whose workplaces use and store large quan- 
tities of industrial chemicals. 

I am here today on the 11th anniversary of the September 11th 
attacks to talk about the critical and unfulfilled need for com- 
prehensive chemical security protections for workers and citizens. 

There were promises and hopes that CEATS would protect Amer- 
ican citizens when it was enacted as a temporary measure before 
a more comprehensive program could be passed. And some security 
measures have been implemented under CFATS. But CFATS is not 
and never will be the comprehensive program that we need to pro- 
tect against an unforeseen terrorist attack. 

Most notable for our members are several gaps in CEATS juris- 
diction that leave millions of Americans and American infrastruc- 
ture at risk. CEATS exempts thousands of water-treatment facili- 
ties containing poisonous chlorine gas and other chemicals. It also 
exempts port facilities on navigable waters which are covered by 
the Maritime Transportation Security Act. 

Many of those port facilities are oil refineries, where our USW 
members work in the vicinity of small towns and major U.S. cities 
like Houston, Philadelphia, Los Angeles, and San Francisco. Other 
facilities that fall outside of CFATS are those under the jurisdiction 
of the U.S. Coast Guard, the Department of Energy, the Depart- 
ment of Defense, and the Nuclear Regulatory Commission. 

CEATS also does not cover chemicals shipped or stored outside 
the fence line in nearby rail yards or elsewhere that may have lit- 
tle or no security measures. It does not prohibit the shifting of 
these risks from one location to another. I have seen pictures and 
gotten accounts from our members of railcars full of hazardous 
chemicals parked for days outside the fence line, within yards of 
a busy road, near homes and other businesses. 

Employers may engage in this form of risk-shifting to be taken 
off the list of high-risk facilities, or risk-shifting could be an estab- 
lished practice, occurring for years, because workers and manage- 
ment simply do not recognize the hazard and the potential for a 
criminal act. Under CFATS, there is no way of knowing if and how 
these risks are being shifted. 

Additionally, CFATS explicitly prohibits the requirement of any 
particular security measures, such as safer chemical processes. My 
colleagues and I work with employers every day. Many take safety 
measures that go above and beyond, but there are always some 
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that will only do the minimum required by law and, as we all 
know, some who won’t even do that. 

Some companies have shifted to safer processes or reduced their 
inventory of hazardous chemicals. These facilities include where 
our USW members make paper, aluminum, glass, and other prod- 
ucts. But many companies will never even look at innovating with- 
out a legal requirement to do so. 

Another important deficiency of CFATS is the lack of a meaning- 
ful role for workers in chemical security. Workers who operate and 
maintain facilities know the most about what needs to be done to 
reduce vulnerability and protect against a terrorist attack. How- 
ever, under CFATS, background checks done by employers or third 
parties may be used against workers or be full of inaccuracies due 
to errors in reporting. CFATS also is lacking in its provisions for 
an appropriate appeal process when errors made in background 
checks improperly exclude workers. 

Employer background checks allow for a risk of releasing per- 
sonal information and may also result in duplication of effort when 
many workers at high-risk sites already must acquire a Transpor- 
tation Worker Identification Credential, a TWIG, issued by the 
TSA, which is part of DHS but separate from the CFATS office. 
TWIC requires background checks, and TSA safeguards personal 
information. 

Workers across this country, those who would be hurt first and 
worst during an attack, need stronger comprehensive chemical se- 
curity legislation that is effectively implemented. Congress can no 
longer simply oversee implementation of a measure that was in- 
tended as temporary. Action is needed to legislate a comprehensive 
chemical security program that addresses the gaps in CFATS that 
leave millions of American workers and their families at risk. You, 
Mr. Chairman, and your committee could take action to make these 
improvements. 

Thank you again for the opportunity to testify today. 

Mr. Shimkus. Thank you very much. 

[The prepared statement of Ms. Fendley follows:] 
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Chairman Shimkus, Ranking Member Green and members of the 
Committee, thank you for the opportunity to testify today on the important 
issue of chemical safety and security. My name is Anna Fendley. I represent 
the Health, Safety and Environment Department for the United Steel, Paper 
and Forestry, Rubber, Manufacturing, Energy, Allied Industrial and Service 
Workers International Union - USW for short. We represent 850,000 
workers in the sectors I just mentioned and many others, including the 
majority of unionized workers in the chemical industry and hundreds of 
thousands of men and women whose workplaces use and store large 
quantities industrial chemicals. 

I am here today, on the eleventh anniversary of the September 1 1* 
attacks, to talk about the critical and unfulfilled need for comprehensive 
chemical security protections for workers and citizens who are put at risk by 
working in or living near the nation’s chemical facilities. 

There were promises and hopes that the Chemical Facility Anti- 
Terrorism Standards Program (CFATS) would protect American citizens 
when it was enacted as a temporary measure before a more comprehensive 
program could be passed. And some security measures have been 
implemented under CFATS. But CFATS is not and never will be the 
comprehensive program that we need to protect against an unforeseen 
terrorist attack or an accidental release that could be equally devastating. 

Most notable for our members are several gaps in CFATS ’s 
jurisdiction that leave millions of Americans and American infrastructure at 
risk. CFATS exempts thousands of water treatment facilities containing 
poisonous chlorine gas and other chemicals because those facilities are 
covered by the Public Health Security and Bio-terrorism Preparedness and 
Response Act of 2002. It also exempts port facilities on navigable waters 
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which are covered by the Maritime Transportation Security Act (MTSA) of 
2002. Many of those port facilities are oil refineries where our USW 
members work in the vicinity of small towns and major US cities like 
Houston, Philadelphia, Los Angeles and San Francisco. Other facilities that 
fall outside of CFATs are those under the jurisdiction of the US Coast 
Guard, the Department of Energy, the Department of Defense and the 
Nuclear Regulatory Commission. 

CFATS also does not cover chemicals shipped or stored outside the 
fence line in nearby rail yards or elsewhere that may have little or no 
security measures. It does not prohibit the shifting of these risks from one 
location to another. I have seen pictures and gotten accounts from our union 
members of rail cars full of hazardous chemicals parked for days outside the 
fence line within yards of a busy road near homes and other businesses. 
Employers may engage in this form of risk shifting to be taken off the list of 
high-risk facilities, or risk shifting could be an established practice occurring 
for years because workers and management simply do not recognize the 
hazard and the potential for a criminal act. Under CFATS there is no way of 
knowing if and how these risks are being shifted, leaving large numbers of 
Americans in danger. 

Additionally CFATS explicitly prohibits the requirement of any 
“particular security measure,” such as safer chemical processes. My 
colleagues and I work with employers every day. Many take safety measures 
that go above and beyond, but there are always some that will only do the 
minimum required by law and as we all know some who refuse to even do 
the minimum required. Some companies have shifted to safer processes or 
reduced their inventory of hazardous chemicals so they are no longer listed 
as high risk. These include high profile companies like Clorox, which 
switched from chlorine gas to the safer liquid bleach. It also includes smaller 
facilities where our USW members make paper, aluminum, glass, and other 
products. But many companies will never even look into innovating with 
safer chemical processes without a legal requirement to do so. Those are the 
facilities that put American workers and their families at risk during a 
terrorist attack. 

Another important deficiency of CFATS is the lack of a meaningful 
role for workers in chemical security. Workers who operate and maintain 
facilities know the most about what needs to be done to reduce vulnerability 
and protect against a terrorist attack. However, under CFATS background 
checks done by employers or third parties mayobe used against workers or be 
full of inaccuracies due to errors in reporting. CFATS also is lacking in its 
provisions for an appropriate appeal process when errors made in 
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background checks improperly exclude workers. Employer background 
checks allow for a risk of releasing personal information and may also result 
in duplication of effort when many workers at high-risk sites already must 
acquire a Transportation Worker Identification Credential (TWIC) issued by 
the Transportation Security Administration, which is part of the Department 
of Homeland Security but separate from the office that oversees CFATS. 
TWIC requires background checks, and TSA safeguards personal 
information. 

Workers across this country, those who would be hurt first and 
worst during an attack, need stronger comprehensive chemical security 
legislation that is effectively implemented. Congress can no longer simply 
oversee implementation of a measure that was intended as temporary. Action 
is needed to legislate a comprehensive chemical security program that 
addresses the gaps in CFATS that leave millions of American workers and 
their families at risk. You, Mr. Chairman, and your committee could take 
action to make these improvements. 

Thank you again for the opportunity to testify today as we remember 
those who were killed in the terrorist attacks on September 1 1* and stand 
ready to work with you to improve chemical plant safety and security. 
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Mr. Shimkus. And, Mr. Orum, you are recognized for 5 minutes. 
Thanks for joining us. 

STATEMENT OF PAUL ORUM 

Mr. Orum. Good afternoon. I am Paul Orum. I am pleased to 
represent the views today important to the Blue Green Chemical 
Security Coalition, as well as findings from research conducted for 
the Center for American Progress and others. 

I plan to make three main points: one, the chemical security 
problem is well-known; two, the current program, CFATS, won’t, in 
my view, fix the problem; and, three. Congress should pass com- 
prehensive chemical security legislation. 

The chemical security problem is well-known. More than two 
dozen government agencies and others have warned that industrial 
chemicals could be intentionally or inadvertently released to cause 
harm. Many of these resources are listed in my testimony, and for 
brevity I won’t repeat them. 

Two, the current temporary Chemical Facility Anti-Terrorism 
Standards won’t fix the problem. The standards lack basic ele- 
ments of an effective program. CFATS exempts drinking-water fa- 
cilities, exempts wastewater facilities, exempts many major refin- 
eries and terminals and chemical manufacturers that happen to be 
on navigable waters. 

It excludes knowledgeable employees and their representatives 
from security planning. It doesn’t allow DHS to require companies 
to fix specific security problems on the ground. It lacks clear dead- 
lines for completion and approval of assessments and plans. It 
lacks basic government accountability measures, such as regular 
progress reports. 

It doesn’t secure chemical supply chains. In my view, it perpet- 
uates uncertainty. And, very importantly, it neglects technological 
changes that can make chemical facilities less attractive targets. 

These flaws are in the law. They are all found in the appropria- 
tions rider that created CFATS as a temporary program. 

Congress should authorize a comprehensive chemical security 
program. The last Congress, about 3 years ago, did so after — the 
House passed after a lengthy consultation with stakeholders in 
four congressional committees. This bill would have closed the 
greatest loopholes while seamlessly incorporating CFATS. It is the 
responsibility of Congress to authorize a comprehensive program. 

In addition. Congress should support, not hinder, existing au- 
thority of the U.S. EPA to promote safer technologies under the 
general duty clause of the Clear Air Act and, likewise, the author- 
ity of DHS to promote intrinsically more secure technologies as a 
security measure under CFATS. 

While Congress should close all the chemical security loopholes, 
I would like to elaborate on two current deficiencies. 

First, government accountability. If we spent $500 million on 
chemical security, it is important for the public to know what the 
effort is producing. 

The comprehensive program passed in 2009 included government 
accountability provisions, namely, regular public progress reports 
to Congress. The reports were to summarize how facilities were 
complying and lay out the basic scope of the program — how many 
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facilities, how many plants, how many approved, and so forth. Had 
these provisions heen included in CFATS, the first report to Con- 
gress would have been due some 5 years ago, and many challenges 
would have come to light systematically rather than as a result of 
leaked internal memoranda. 

In my opinion, the program will inevitably lack public credibility 
if it doesn’t require a complete public accounting of facilities and 
scope and progress. 

An effective program should also help companies identify and re- 
move avoidable chemical hazards. Under CFATS, DHS has not de- 
veloped the removal of unnecessary chemical targets as a security 
measure. 

We know that some 1,600 or more facilities have reportedly re- 
moved chemicals of concern and others have dropped below report- 
ing thresholds. While we lack basic public information about these 
changes, the numbers do suggest that much more than this could 
be done with a structured program. 

Each facility that tiers out of the program is a facility that DHS 
does not have to oversee. Removing unnecessary targets should be 
one of the tools in the chemical security toolbox. 

Thank you again for the opportunity to testify. Please let me 
know of any questions or ways that I or my colleagues can be help- 
ful to the committee. 

Mr. Shimkus. Thank you very much. 

[The prepared statement of Mr. Orum follows:] 
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My name is Paul Orum, and I have worked more than 20 years for 
effective chemical safety and security policies, most recently as a 
consultant to public interest organizations. My primary expertise is 
government information policy regarding hazardous chemicals. 
Thank you for the opportunity to testify on the nation’s chemical 
security program. 

The Blue Green Chemical Security Coalition of labor, community, 
and public health organizations supports chemical security policies 
that include safer and more secure technologies, employee 
participation, and government accountability. Two relevant letters 
from this coalition are attached to my testimony. 

I will make three main points: 

1) The problem is well known; 

2) The current program won’t fix the problem; 

3) Congress should pass comprehensive chemical security 
standards. 
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1. The chemical security problem is well known. 

Many government agencies and others have documented the 
problem. Large quantities of industrial chemicals can cause serious 
harm if suddenly released, particularly in populated areas, and 
cannot be secured by conventional security alone. 

• More than two-dozen government agencies, industry 
associations, labor unions, insurers, think tanks, public 
interest groups, and others have warned that industrial 
chemicals could be intentionally or inadvertently released to 
cause harm in workplaces, businesses, and communities.' 

• Some 480 industrial facilities across the country pose worst- 
case chemical release hazards to any of 100,000 or more 
nearby residents." 

• Local emergency response capacities are not typically 
sufficient or designed to handle a worst-case release. 

• A worst-case release is a low probability, high consequence 
event that is difficult for market forces to account for without 
government standards. 

The problem is well known. Effective action is overdue. 

2. Current temporary Chemical Facility Anti-Terrorism 
Standards (CFATS) won’t fix the problem. 

The current temporary standards lack basic elements of an 
effective program. The CFATS program: 

• Exempts drinking water facilities; 

• Exempts wastewater facilities; 

• Exempts many major refineries, terminals, and chemical 
manufacturers that happen to be on navigable waters;"' 
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• Excludes knowledgeable employees and their representatives 
from security planning; 

• Does not allow the Department of Homeland Security (DHS) 
to require companies to fix specific security problems on the 
ground; 

• Lacks clear deadlines for the completion and approval or 
disapproval of facility security assessments and plans; 

• Lacks basic government accountability measures such as 
regular progress reports to Congress; 

• Does not provide citizen enforcement suits or petitions of the 
government to ensure implementation; 

• Does not secure chemical supply chains, relying instead on 
conventional security and continuing current indirect 
subsidies that encourage pervasive shifting of chemical 
hazards among locations; 

• Perpetuates uncertainty by sinking time and resources into 
conventional security measures that may inevitably fall short; 

• Neglects technological changes that can make chemical 
facilities less attractive targets — ^the most foolproof 
solution — while modernizing operations. 

The flaw is in the law. These deficiencies are all in the 
appropriations rider that created CFATS as a temporary program. 

3. Congress should authorize a comprehensive chemical 
security program. 

The last House of Representatives passed a credible compromise 
bill (H.R. 2868, lll‘^ Congress) after lengthy consultation with 
stakeholders and four Congressional Committees. This bill would 
have closed the greatest security loopholes while seamlessly 
incorporating CFATS, but the Senate failed to act. It is the 
responsibility of Congress to authorize a comprehensive program. 
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In addition, Congress should support, not hinder, the existing 
authority of the Environmental Protection Agency to promote safer 
technologies under the general duty clause of the Clean Air Act.''' 
Congress should likewise support the authority of the Department 
of Homeland Security to promote intrinsically more secure 
technologies as a security measure under CFATS. 

While Congress should close all the chemical security loopholes, I 
would like to elaborate on two current deficiencies: 

Government Accountability 

If Congress directs millions of dollars to chemical security, it is 
important for the public to know what the effort is producing. The 
comprehensive program passed in 2009 (H.R. 2868, 111* 
Congress) included government accountability provisions that are 
much more structured than the leaked documents by which 
Congress is now belatedly reviewing the program — ^namely regular 
public progress reports to Congress. 

The reports were to summarize how facilities were complying with 
performance standards and to enumerate the basic scope of the 
program, such as the number of facilities that: 

• possess chemicals of concern; 

• are assigned a risk tier by DHS; 

• submit vulnerability assessments and site security plans; 

• have assessments and plans approved or disapproved; 

• have received compliance orders, civil penalties, or 
administrative penalties, 

• exit the program and the methods used; 

• and other relevant measures of program activity.'' 

Had these oversight provisions been included in CFATS, the first 
report to Congress would have been due some five years ago, with 
subsequent reports due regularly thereafter. Many implementation 
challenges would have come to light systematically years ago 



86 


rather than as the result of an internal memorandum leaked to the 
news media. Oversight by leaked memoranda is not as effective as 
regular public progress reports. 

The program will inevitably lack public credibility if it doesn’t 
require a complete public accounting of facilities, scope, and 
progress. Periodic progress reports provide a basis to monitor and 
improve implementation. 

Intrinsically More Secure Facilities 

An effective chemical security program should help companies 
identify and remove avoidable chemical hazards. Such provisions 
were included in the comprehensive bill of 2009. In comparison, 
under CFATS the DHS has not developed the removal of 
unnecessary chemical targets as a security measure. 

Under CFATS more than 1,600 facilities have reportedly 
completely removed their chemicals of concern, and more than 700 
additional facilities have reduced chemicals below high-risk 
thresholds. While we lack basic public information about these 
changes, the numbers do suggest that much more could be done 
with a structured program that requires companies to do their 
homework. Each facility that tiers-out of the program is a facility 
that DHS does not have to oversee. Removing unnecessary targets 
should be one of the tools in the chemical security toolbox. 

Policy makers need better information from covered facilities 
about methods to remove avoidable chemical hazards. The 2009 
House-passed bill required high hazard chemical facilities to report 
to DHS “the technical feasibility, costs, avoided costs (including 
liabilities), personnel implications, savings, and applicability of 
implementing each method to reduce the consequences of a 
terrorist attack.”''" 
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Such reporting would help generate solutions. It should produce 
information on the substances, industry sectors, and processes 
involved at facilities that tier-out of the program, and the most 
common methods used such as: substituting a less hazardous 
chemical; using a chemical in a less hazardous form; using an 
alternate process; producing and using a chemical as needed in 
process without storage; or reducing inventory. 

Survey reports I produced through the Center for American 
Progress identified alternatives that are already in use at hundreds 
of facilities across more than 20 industry sectors.''" But even in 
industry sectors that show gradual improvement, such as water and 
wastewater treatment, it would take more than half a century to 
remove high-hazard processes. A structured program can 
accelerate progress. 

Thank you for the opportunity to testify. Please let me know any 
questions and ways that I, or my colleagues, can be helpfol to the 
Committee. 

Attachments: 

Blue-Green Coalition letter to House of Representatives, June 21, 201 1. 
Blue-Green Coalition letter to President Obama, May 16, 2012. 


‘ Sample reports and statements warning about chemical terrorism include: 

• The Chemical Threat to America, by Christine Todd Whitman in the New York Times, August 29, 
2012. 

• Preventing Toxic Terrorism: How Some Chemical Facilities are Removing Danger to American 
Communities, Center for American Progress, 2006. 

• Toxic Trains and the Terrorist Threat: How Water Utilities Can Get Chlorine Gas off the Rails and Out 
of American Communities, Center for American Progress, 2007. 

• Chemical Security 101: What You Don’t Have Can’t leak, or Be Blown Up by Terrorists, Center for 
American Progress, 2008. 

• Safer Chemicals Create a More Secure America: We Can Diminish the Security Threat from Chemical 
Plants, Center for American Progress, 2010. 

• Wastewater Facilities: Experts’ Views on How Federal Funds Should Be Spent to Improve Security, 
Government Accountability Office, GAO-05-165, January 2005. 

• Chemical Terrorism: US Policies to Reduce the Chemical Terror Threat, Partnership for a Secure 
America, September 2008. 

• National Planning Scenario 8: Chemical Attack — Chlorine Tank Explosion, Homeland Security 
Council in partnership with the Department of Homeland Security, 2005. 
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• Statement before the U.S. House of Representatives Committee on Transportation and Infrastructure, 
Subcommittee on Railroads, Association of American Railroads, June 13, 2006. 

• Homeland Security Committee Urged to Consider Safer Chemicals; Chemical Companies Should Stop 
Manufacturing Extremely Dangerous Chemicals, Association of American Railroads, 2008. 

• Catastrophe, Injury, and Insurance: The Impact of Catastrophes on Workers Compensation, Life, and 
Health Insurance, Risk Management Solutions, Inc., 2004. 

• Assessing Terrorist Motivations for Attacking Critical “Chemical” Infrastructure, Laurence Livermore 
National Laboratory, December 20, 2004. 

• Testimony of Dr. Jay Boris before the City Council of the District of Columbia, U.S. Naval Research 
Laboratory, October 6, 2003. 

• A Method to Assess the Vulnerability of U.S. Chemical Facilities, National Institute of Justice, U.S. 
Department of Justice, November 2002. 

• Strategic Plan for Homeland Security, U.S. Environmental Protection Agency, September 2002. 

• Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of 
Security Preparedness is Unknown, U.S, General Accounting Office, GAO-03-439, March 14, 2003. 

• Homeland Security and the Private Sector, Congressional Budget Office, December 2004. 

• Statement by the Department of Homeland Security on Continued Al-Qaeda Threats, Department of 
Homeland Security, November 21, 2003. 

• Industrial Chemicals and Terrorism: Human Health Threat Analysis, Mitigation and Prevention, 
Agency for Toxic Substances and Disease Registry, 1999; and, Terrorist Use of Expedient Chemical 
Agents: Health Risk Assessment and Las Vegas Case Study, Agency for Toxic Substances and Disease 
Registry, undated. 

• Study Assesses Risk of Attack on Chemical Plant, Army Surgeon General reported in Washington 
Post, March 12, 2002. 

• The Terrorist Threat in America, Chemical Manufacturers Association (American Chemistry Council), 
April 1998. 

• PACE International Union Survey: Workplace Incident Prevention and Response Since 9/1 1, Paper, 
Allied-Industrial, Chemical and Energy Workers International Union (PACE), October 27, 2004. 

• America the Vulnerable: How Our Government Is Failing to Protect Us From Terrorism, Stephen 
Flynn, 2004. 

• Protecting the American Homeland, Brookings Institution, March 2002, 

• Toxic Warfare, RAND Corporation, 2002. 

• News Release: Chemical Facilities Vulnerable, Center for Strategic and International Studies, 
December 23, 2003. 

• Eliminating Hometown Hazards: Cutting Chemical Risks at Wastewater Treatment Facilities, 
Environmental Defense, December 2003. 

• The Safe Hometowns Guide, The Safe Hometowns Initiative, 2002. 

• Needless Risk: Oil Refineries and Hazard Reduction, U.S. PIRG Education Fund, August 2005. 

• Unnecessary Dangers: Emergency Chemical Release Hazards at Power Plants, Working Group on 
Community Right-to-Know, July 21, 2004. 

• Chemical Plants Remain Vulnerable to Terrorists: A Call to Action. United Steelworkers of America, 
undated. 

• High Alert: Workers Warn of Security Gaps on Nation’s Railroads, International Brotherhood of 
Teamsters, 2005. 

• Making the Nation Safer: The Role of Science and Technology in Countering Terrorism, National 
Research Council, National Academy of Sciences, 2002. 

• Terrorism and the Chemical Infrastructure: Protecting people and Reducing Vulnerabilities, National 
Research Council, National Academy of Sciences, 2006. 

• The Use and Storage of Methyl Isocyanate (MIC) at Bayer CropScience, National Research Council, 
National Academy of Sciences, 2012. 

“ Congressional Research Service, Memorandum to Senator Frank Lautenberg, April 12, 201 1 . 

Sample Maritime Transportation Security Act regulated facilities that are reportedly exempt from CFATS 

include: Kuehne Chemical, South Kearny, N,J.; Citgo Refinery, Corpus Christ!, Texas; Valero Refinery, 
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Port Arthur, Texas; Marathon Refinery, Texas City, Texas; Bayer CropScience, Institute, W.V.; Dow 
Chemical, Freeport, Texas. 

" See the National Environmental Justice Advisory Council letter to EPA Administrator Lisa Jackson, 
March 14, 2012. htlDs://s3 .amazonaws.com/s3.documentcloud.ore/documents/33204 1 /neiac-letter.pdf 
' H.R. 2868, 1 1 1* Congress, Section 2119. 

” H.R. 2868, 1 U Congress, Section 2 1 1 1 . 

Center for American Progress: Leading Water Utilities Secure Their Chemicals (2010); Chemical 
Security 101: What You Don’t Have Can’t Leak, Or Be Blown Up by Terrorists (2008); Toxic Trains and 
the Terrorist Threat: How Water Utilities Can Get Chlorine Gas Off the Rails and Out of American 
Communities (2007); Preventing Toxic Terrorism: How Some Chemical Facilities Are Removing Danger 
to American Communities (2006). 
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Mr. Shimkus. I am going to ask unanimous consent that Mr. 
Pompeo can sit in. I know there may be another from your side 
joining us. And then, as per tradition, if members of the sub- 
committee are done asking their questions, then we will go to other 
members from the full committee who are joining us. 

So, with that, I recognize myself for 5 minutes, and my questions 
will start with Mr. Scott. 

It is my view that CFATS officials are trying to operate a regu- 
latory program like a police program. This brings me to concerns 
with the personnel surety program, which has been addressed a 
couple times today already. 

As I understand it, the terrorist screening database is operated 
by the Federal Bureau of Investigation, not DHS. Under another 
DHS program, the Maritime Transportation Security Act — we do a 
lot of acronyms, so I like to read these out — if someone with a 
TWIG card gets a hit on the terrorist screening database, the 
TWIG is automatically deactivated and the facility notified. Min- 
imum DHS interference in that process. 

Under GFATS, the program seems to insist that all information 
be passed through them to the FBI but that the Infrastructure Se- 
curity Gompliance Division cannot let a facility know if a terrorist 
is working in their plant. 

Do you agree with me that DHS is not trying to operate GFATS 
like it was intended by Gongress but more like a policing and re- 
sponse program? 

Mr. Scott. Yes, sir. They seem to be gathering information and 
holding information within DHS instead of sharing in a partner- 
ship, as we started out. 

So the TWIG program and the background check program, per- 
sonnel surety is one example of that, where we would be required 
to submit information to DHS and really never get an answer back. 
Especially concerning is we don’t get an answer back if they do 
have somebody that is a hit in the terrorist database. We are going 
to have them — if they don’t tell us, we still have a potential ter- 
rorist working in our plant, and that is absolutely crazy. 

Mr. Shimkus. And the first panel, as I was talking to Under Sec- 
retary Beers and I — how can you give approval or the wink and 
nod that a facility has been approved when they really haven’t es- 
tablished the personnel surety program in an operation? I would 
think that would be the number-one concern. 

If DHS has no response function, is there a reason why the facil- 
ity cannot communicate directly with the FBI? 

Mr. Scott. No, there is absolutely no reason. In fact, most facili- 
ties are going to communicate with their local Joint Terrorism Task 
Force and the FBI and the local law enforcement. I mean, that is 
the response agencies for a situation that does occur at your site. 

Mr. Shimkus. Has your experience under the MTSA, which is the 
Maritime Transportation Security Act, led you to believe that it is 
doable to prevent known terrorists from wandering around a land- 
based plant? 

Mr. Scott. Several of our larger sites are covered under the Mar- 
itime Transportation Security Act. And we have a very good rela- 
tionship, and the Goast Guard is a very strong organization, both 
on the response side and the enforcement side, and have worked 
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with us very closely because our MTSA sites have the same secu- 
rity upgrades and same security programs as all of our CFATS-cov- 
ered sites. 

Mr. Shimkus. Why do you believe strongly, as some of the panel- 
ists do not, that EPA should not be the chemical security agency 
for the Federal Government? 

Mr. Scott. Well, the general duty clause was — it came to us 
under the Clean Air Act. It is specifically designed for environ- 
mental protection and does a very good job — EPA does a very good 
job in that respect. They do not have a lot of expertise in site-secu- 
rity types of programs, and we don’t really need to start over with 
a new agency, to go back to square one and try to do this again. 

Mr. Shimkus. Thank you. 

Let me turn to Mr. Leary now, because Dow — monstrous, big; 
Mr. Leary — small, hopefully profitable. 

You testified that you have limited capital to invest in needs 
across your plants, not just CFATS-related ones. So what percent- 
age of your capital is being tied up by the poor implementation of 
the CFATS program? 

Mr. Leary. Chairman, I can’t really speak to the corporation, but 
I can, as an example, talk to you about my department’s budgetary 
concerns. And at least in what I have just submitted — our fiscal 
year runs September — and I think security accounted for over 100 
percent of the budget, as compared to everything else that we are 
tasked to do. 

Mr. Shimkus. How do we assure that the real financial needs of 
your security professionals are taken seriously within the context 
of CFATS implementation? 

Mr. Leary. Chairman, I can only speak for Pilot in this respect. 
And I am very proud to report to the subcommittee that I have 
been given more than enough support to do so. And at least from 
a Pilot perspective, there have been no issues whatsoever in terms 
of getting support to go ahead and do what we have to do under 
the standard. 

Mr. Shimkus. Thank you. 

I have 13 seconds left. I will yield back my time and turn to my 
ranking member, Mr. Green, for 5 minutes. 

Mr. Green. Again, thank you for being here and patient today. 

Were you here during the first panel? 

Mr. Leary. Uh-huh. 

Mr. Green. The question for all of you, including the U.S. Steel- 
workers, is that the CFATS personnel surety program proposal was 
recently rescinded and received much criticism from industry and 
unions. Can you explain what the criticism was? And how did DHS 
respond to your concerns? 

Mr. Scott. I will be glad to address that a little bit. 

The concern is the burden on industry. You have many sites 
that, mentioned earlier, have a contractor base that travels along 
the gulf coast, for example, during all the shutdowns, and you may 
have thousands of new employees coming in on a daily basis for a 
shutdown. And they may show up at The Dow Chemical Company 
today, and we would have to submit a thousand names. And they 
may show up tomorrow at one of our neighboring companies, and 
they will have to submit the same thousand names. 
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It is a very burdensome process. And they don’t recognize any 
easy solutions that are out there, like a TWIG card from MTSA. 

Mr. Green. And I have a Dow facility in my district, not your 
largest, obviously, not Freeport, but I assume the contractors have 
their TWIG cards. 

Mr. Scott. Most contractors on the gulf coast have a TWIG card 
and they travel between sites. 

Mr. Green. Yes. OK. 

Any other response to that? 

Were the steelworkers brought in? I am glad, you know, the in- 
dustry — was the small chemical — I have to admit, I don’t have 
many small plants in our area; we have big plants. But were the 
small plant owners also brought in, along with steelworkers? 

Mr. Leary. Yes, I will — at the recent security summit, put on by 
SOGMA and I believe cosponsored by DHS, actually Pilot had an 
opportunity to sit in on a roundtable with DHS regarding just this 
topic. And I was surprisingly pleased that we were actually asked 
our opinion. And so I do believe at least they are concerned about 
our opinions. 

Mr. Green. Ms. Fendley? 

Ms. Fendley. To my knowledge, we were not brought in. But we 
are very concerned about the deference to industry, as well, and 
the lack of an appeals process if there is an error. 

Mr. Green. You know, it seems like the testimony from our pre- 
vious panel said that they were working with the employee groups. 
Did I mishear that from the earlier panel? That is what I am con- 
cerned about. And believe me, we want everybody at the table, you 
know, about whether it be the industry, small or large, but also the 
employees involved there. 

Maybe that opening went because they announced that they 
were going to deal with using the TWIG-type application, which I 
know — I have lots of steelworkers, I have four of my five refineries 
and a number of my chemical plants are organized by the steel- 
workers. And a few years ago, we had problem-solving, because 
some of my constituents were denied their TWIG card, but then we 
would find out it was a mistake, and we would work with them on 
that. And I know, with our renewal coming up now, it is going to 
be a problem. 

But we understand the problem we have. We don’t want to re- 
invent it with another type of surety. And that is what worries me. 
They ought to base it on whether you are — and Dow has, at least 
in my area, they are all waterside, both Freeport and the one on 
the Houston Ship Ghannel. But I know you have plants that are 
not. 

And is Pilot covered by it in Gincinnati 

Mr. Leary. No, sir. 

Mr. Shimkus [continuing]. The TWIG card? 

Mr. Leary. No, sir. It is not. Actually, our knowledge of the 
TWIG beyond these proceedings and our involvement with SOGMA 
is somewhat minimal. 

Mr. Green. OK. All right. Well, we will continue to encourage 
them to bring everybody at the table. 
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And a question for anyone else on the panel: What would you 
like to see DHS do to help achieve a more smooth implementation 
of the CFATS program? 

One of the things we have all recognized, there has to be some 
continuity and real reauthorization. And we haven’t seen that, and 
I don’t think we will see that this Congress. But the year-to-year 
is an issue. 

But we also need to make sure — because my complaint is that 
the year-to-year, a lot of industries don’t want to spend — they want 
to make sure what they are doing is going to be compliant with 
whatever DHS comes out with. 

Is that an issue that you all dealt with within your companies? 

Mr. Leary. From a Pilot perspective, that is one of the biggest 
issues, actually. I could easily recount, for much longer than al- 
lowed, discussions with our finance director regarding the difficul- 
ties in budgeting for securing our facilities. We are very much 
afraid that we will be looking at an SSP approval and immediately 
have to expend thousands of dollars. 

Mr. Green. Mr. Scott, one of the concerns I have, because, lit- 
erally, Dow’s facility is back-to-back in my area, along with a lot 
of other ones, in the testimony that I have read shows that, is 
there an issue with industry taking chemicals that are produced in 
our plants and leaving it at unsecured facilities off-plant-site? 

You know, that bothers me because, again, I would see, in our 
district — and I haven’t had any complaints, but I know that is what 
Ms. Fendley’s testimony that is submitted included. And that is a 
security issue, whether it is made at ABC or Dow or ExxonMobil 
or anybody else, that some volatile chemicals are not in a secure 
facility, including a rail yard that has protections off-site. 

Mr. Scott. Sir, we have put the same restrictions, the same re- 
quirements on our shippers and on the people that — and I am talk- 
ing about Dow Chemical now — ^but, in general, the ACC member 
companies. As part of the Responsible Care Code, security is from 
the production site to the delivery to the customer. So we have a 
strong security program in place. 

And Dow, in particular, we have submitted our site security 
plans to the DHS Safety Act Office and had the site security plans 
approved. And our transportation distribution security plans also 
have certification under the DHS Safety Act Office, which is kind 
of the Good Housekeeping seal of approval. 

So that whole chain of events takes a significant amount of secu- 
rity. So I think ACC member companies certainly take that into 
consideration under the Responsible Care Code. 

Mr. Green. OK. 

Thank you, Mr. Chairman. 

Mr. Shimkus. The gentleman’s time has expired. 

The chair now recognizes the gentleman from the State of Kan- 
sas, Mr. Pompeo, for 5 minutes. Welcome to the subcommittee. 

Mr. Pompeo. Thank you, Mr. Chairman, thank you, Mr. Green, 
for allowing me to participate today. I appreciate it. 

Look, Mr. Scott, I have two questions for you that I wanted to 
come here today and speak about. The first is, in your written tes- 
timony, you talked about some of the problems in DHS’s program, 
but you were very clear that the program is fundamentally sound. 
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it is risk-based, it is focused on the right set of priorities, so DHS, 
in large measure, has it right. And there are things that we can 
improve on and tweak, but it has largely got it right. 

There are some folks who disagree with that. Former EPA Ad- 
ministrator Christie Whitman said that EPA should be the primary 
agency in charge of chemical security. Greenpeace has said that 
EPA already has the power under the general duty clause, in their 
view. There have been folks at EPA who have suggested that, as 
well. 

As someone who has watched EPA in other places do real harm 
to potentially tens and tens of thousands of jobs across America, 
that causes great concern to me. 

I have introduced legislation that clarifies what I think is al- 
ready pretty clear regarding the general duty clause. It would re- 
quire EPA to complete a rulemaking process before finding any fa- 
cilities in violation of the general duty clause. And it would clarify 
EPA’s jurisdiction by prohibiting it from regulating chemical secu- 
rity through section 112(r)(l), the general duty clause. 

What is your view, Mr. Scott, on the recent calls by the environ- 
mental community to try and use the Clean Air Act to regulate 
chemical security when we already have this enormous apparatus 
in place? 

Mr. Scott. Well, first, we think your legislation is a step in the 
right direction to clarify roles and responsibilities. 

As I mentioned earlier, EPA and the general duty clause came 
under the Clean Air Act, and EPA is very strong on environmental 
protection and not as strong in site security, physical security, 
transportation security — all the things that come into the supply 
chain around the chemical industry. So that is not their area of ex- 
pertise, and that is exactly the reason why chemical security was 
put under the Department of Homeland Security, the focus on se- 
curity and all things in addition to chemical security. 

So the expertise and the foundation for the CFATS program lies 
with DHS, not with EPA. So I don’t think we should muddy the 
waters, change in midstream, or even take one step back. We need 
to move forward with DHS. 

Mr. POMPEO. Right. Do you think there is also some risk that, 
when you have two agencies in, it is contradictory, they present 
competing demands on entities, and all of a sudden we are in a 
worse place than we are even today with the challenges DHS is 
facing? Do you think there is some risk of that, as well? 

Mr. Scott. I think if we are going to put an effort in to combine 
some things, it certainly shouldn’t b^e with DHS and EPA. I would 
look to continue the harmonization with MTSA and CFATS, Coast 
Guard and DHS. A lot of the facilities are very similar. A lot of the 
facilities are already covered by one or the other or sometimes 
both, and I think they can be harmonized extremely well. 

Dow has built our security programs — whether it is a CFATS site 
or an MTSA site, we put security in place at the same level. And 
I think that is the direction we should go if we are going to har- 
monize. 

Mr. PoMPEO. Well, thank you. I appreciate that. 

Your testimony also strongly supported the use of alternative se- 
curity programs in CFATS by DHS. How broadly do you think the 
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ASBs should be applied under CFATS? Is it by facility? Or by sec- 
tor? Do you have a view, does Dow have a view on that? 

Mr. Scott. Well, again, it depends on the site. But you could cer- 
tainly expand an alternative security plan to companies that puts 
similar security programs in place throughout all of their regulated 
sites. 

So the alternative security plan, the only intent is to give DHS 
all the information they need to make a decision, improve the secu- 
rity of the site, and make it easier on the submission of the infor- 
mation to DHS. That is the goal of an alternative security plan. 

Mr. PoMPEO. I appreciate that. 

Last question: Do you think that the ASP provides any less pro- 
tection for a facility than if the facility were to go through the en- 
tire CFATS compliance regime? Or do you think it achieves the 
same objective? 

Mr. Scott. It is the same objective. It is just a different way to 
submit the site’s plan, and it is a more expeditious way to submit 
the site’s plan. So there is no difference in the end result. It is ei- 
ther approved or it is not approved, and the security upgrades are 
the same. 

Mr. PoMPEO. Great. Thank you. 

Thank you, gentlemen. 

I yield back the balance of my time. 

Mr. Shimkus. The gentleman yields back his time. 

The ranking member has asked unanimous consent to ask one 
additional question. Mr. Pompeo, you may want to stay around and 
listen to the answer. 

And, without objection, the gentleman is recognized. 

Mr. Green. I would just like the panel, if you would give us an 
opinion. We are having a hearing on Mr. Pompeo’s bill. I have some 
concern, but would you all have any opinion on it? I know it is not 
on the list. 

Mr. Orum. Yes, I do. 

Mr. Green. We will go right to left this time. 

Mr. Orum. Recall that EPA is the lead agency for security at 
water and wastewater facilities, which are CFATS-exempt. But 
also, more generally, for chemical facilities, people in communities 
don’t necessarily make much of a distinction whether it was inad- 
vertent or deliberate if a gas cloud comes to where they are. 

When EPA acts to reduce catastrophic hazard potentials under 
its authorities, it has the secondary benefit of removing terrorist 
targets. So it is not necessarily so that EPA is acting as a security 
agency, but it may yet have security benefits. 

Mr. Green. Ms. Fendley? 

Ms. Fendley. I would agree with Mr. Orum. For workers at 
these sites, the potential for a terrorist attack and the potential for 
an accidental release, you know, they would have the same effect. 
And if EPA can also work to reduce the presence and the quan- 
tities of hazardous chemicals on these sites, we are incredibly sup- 
portive of that. 

Mr. Leary. SOCMA most certainly supports the bill as intended. 
And I really can’t — I think Mr. Scott said it all in regards to our 
feelings, as well. 
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Mr. Scott. I have no disagreement as far as the routine oper- 
ation of the plant. We don’t want an accidental release. We don’t 
want an attack that causes a release. 

EPA takes care of the first part. And we do run our plants safely 
and securely and within EPA guidelines for routine operations. I 
think we need the focus on security to really improve the overall 
security of the sector coming from DHS. 

Mr. Green. I have to admit, I have some concern about two Eed- 
eral agencies dealings with it because we have enough trouble now 
with DHS doing their job. But, you know, EPA does have statutory 
authority already on certain things. But I would hope our Eederal 
agencies would work together, instead of you having to jump 
through two hoops. You at least know that these agencies are on 
the same page. 

Mr. Shimkus. With that — and I would just weigh in in saying, 
obviously I don’t think the general duty clause has relevance in 
plant security issues. 

So, with that, we appreciate the testimony and the second panel 
coming. 

All members of the subcommittee have 5 days to submit opening 
statements, have 10 days to submit written questions. 

One letter from the American Fuels and Petrochemical Manufac- 
turers is inserted into the record. Without objection, so ordered. 

[The information follows:] 
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Charies T. Ekevna 
Resident 


Amwican 

Fuel & PetrochwTOca! 
Manufacttjrers 


'T 

1667 K Street NW 
Suite 700 
Washington, DC 
20006 

202.457.0480 office 
202.552,8457 direct 
202.457,0486 fax 
Cdrevna@a^m.O]^ 

September 10, 2012 


The Honorable John Shimkus 
Chairman 

U.S. House Subcommittee on 
Environment and the Economy 
2125 Rayburn House Office Building 
Washington, D.C. 20515 


The Honorable Gene Green 
Ranking Member 
U.S. House Subcommittee on 
Environment and the Economy 
2125 Rayburn House Office Building 
Washington, D.C. 20515 


RE: Subcommittee Hearing on Chemical Facility Anti-Terrorism Standards 
Dear Chairman Shimkus and Ranking Member Green: 

AFPM, the American Fuel & Petrochemical Manufacturers, appreciates the opportunity to submit 
this written statement for the record for the House Energy and Commerce Subcommittee on 
Environment and the Economy hearing on the “Chemical Facility Anti-Terrorism Standards 
(CFATS) program - A Progress Report.” 

AFPM is a 1 10-year old trade association formerly known as NPRA, the National Petrochemical & 
Refiners Association, until earlier this year. AFPM represents high-tech American manufacturers 
that use oil and natural gas liquids as raw materials to make virtually the entire U.S. supply of 
gasoline, diesel, jet fuel, other fuels and home heating oil, as well as the petrochemicals used as 
building blocks for thousands of vital products in daily life. AFPM members make modem life 
possible while keeping America moving and growing as we meet the needs of our nation and local 
communities, strengthen economic and national security, and support 2 million American jobs. 

America’s refining and petrochemical companies play a pivotal role in ensuring and maintaining the 
security of America’s energy and petrochemical infrastructure. Nothing is more important to 
AFPM’s member companies than the safety and security of our employees, facilities and 
communities. Our members have worked extensively with DHS - and have invested millions of 
dollars - toward strengthening facility security. Our industry recognizes that protection of critical 
infrastructure against potential threats or terrorist attacks should be a shared responsibility between 
government and stakeholders. 


AFPM appreciates that DHS conducted an internal review to identify administrative problems that 
need fixing immediately and that the agency developed an action plan for improving CFATS 
implementation. It is important to recognize that the structure of the CFATS framework itself is 
sound. Since the beginning of the CFATS program, DHS and industry, including some AFPM 
members, worked together and developed robust, risk-based performance standards (RBPS) that 
avoid being too prescriptive for an industry as diverse in size and function as the chemical sector. 



98 



but that also include strict enforcement penalties for noncompliance. For example, each site 
develops a unique and appropriate Site Security Plan to address the specific risk issues of the 
facility, while meeting DHS-established performance standards. Since the inception of CFATS, 
hundreds of regulated facilities have proactively invested in security to comply with, and indeed 
exceed, requirements of the regulations. 

Since the development of the CFATS program AFPM’s members have also partnered with DHS on 
many important security initiatives and programs, including the Risk Assessment Methodology for 
Critical Asset Protection (RAMCAP), Site Vulnerability Assessments (SVAs), Site Security Plans 
(SSPs), and by our participation in the Chemical Sector Coordinating Council (CSCC) and the Oil 
and Natural Gas Sector Coordinating Council (ONGSCC). 

America’s critical infrastructure facilities are secure and there have been no terrorist attacks on 
chemical facilities since the development of the CFATS program. Despite some implementation 
challenges. Congress should continue to provide sufficient funding for the CFATS program. 
Inadequate funding for the CFATS program would create a major setback to the implementation of 
the program. In particular, resources that government and industry have invested in CFATS 
implementation would effectively be stranded. Nonetheless, it is clear that DHS needs to better 
manage its resources and set priorities to make progress in areas that need immediate attention, 
including approving site security plans and conducting inspections. Such measures would work to 
strengthen the program and our national security. They would also ensure more efficient, effective 
use of taxpayer dollars. 

To assist DHS in addressing these CFATS implementation challenges, additional stakeholder input 
is needed. Areas that industry and DHS should focus on include technical, training and tool-related 
issues that were identified in the DHS internal review. Greater transparency from DHS is critical to 
an effective collaboration moving forward. 

To be clear, AFPM recognizes that there are internal personnel and financial issues within DHS that 
must be addressed administratively where industry has no role. However, DHS could address the 
following issues quickly, with the help of industry, in order to enhance the effectiveness of CFATS 
implementation in the short-term. 

• Personnel Surety Program - Congress intended that the Risk-Based Performance Standard 
12 on Personnel Surety, which governs access to high-risk facilities, be written as a 
performance standard allowing facilities the flexibility to determine the most efficient 
manner to meet the standard. Instead, DHS initially proposed a personnel surety program 
that fails to recognize, and actually duplicates, established federal vetting programs. Such a 
program would be burdensome to both DHS and industry and would be a wasteful and 
ineffective use of agency and industry resources. In July, DHS withdrew its proposal on the 
Personnel Surety Program from the Office of Management and Budget (OMB). However, 
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as DHS works to resubmit a proposal, it is important that any proposal follow Congressional 
intent and be written as a performance standard. Facilities should have the option to use 
established federally secure vetting programs, such as the Transportation Worker 
Identification Credential (TWIC), to satisfy CFATS without submitting additional personnel 
information to DHS. DHS should remain focused on fixing the current problems and not 
expand beyond the scope of the core program. 

AFPM is encouraged and applauds DHS for taking another look at this issue. Moreover, 
AFPM is pleased that DHS has decided to hold a series of meetings with industry, and hopes 
that collaboration will yield a less burdensome, yet still protective PSP for CFATS sites. 

• Site Security Plans - DHS should focus on Tier 1 Site Security Plan (SSP) approvals. 
Moreover, to reduce confusion about DHS’ expectations for SSPs, AFPM recommends that 
DHS conduct a series of outreach meetings to educate industry about their expectations for 
necessary components of SSPs. These outreach meetings would allow DHS to discuss, with 
the actual owners and operators of CFATS sites that have completed an SSP, the flaws in 
the site’s SSP and work collaboratively on solutions. 

DHS should also consider approving alternative security plans (ASPs) for a variety of 
CFATS sites. DHS should work with all sectors governed by CFATS to develop ASPs. For 
sites that are smaller or contain fewer chemicals of interest (COls) an ASP makes sense and 
review and approval time for ASPs should not take as long as for a regular SSP. 

• Inspections - Inspections are a key part of the SSP approval process. Like SSPs, DHS 
should focus on Tier 1 sites, DHS recently started up CFATS inspector training courses and 
developed new inspection guidelines for inspectors. AFPM has offered multiple times for 
DHS to have our members speak at the inspector training classes to provide an overview of 
the chemical and oil and natural gas industry and the CFATS applicability issues at those 
sites. To date, DHS has yet to take us up on this offer. AFPM believes this would be an 
invaluable opportunity for new inspectors to learn about security practices at CFATS sites 
prior to going to a site. AFPM hopes that DHS will consider this offer. 

• Risk Modeling - AFPM is concerned that the DHS risk modeling used for setting risk tier 
levels for facilities in CFATS is seriously flawed. More specifically, and troubling, is that 
the release modeling for both flammables and toxins is incorrect. The risk modeling of the 
CFATS sites is the foundation of the CFATS program and AFPM urges DHS to 
expeditiously establish a stakeholder workgroup to resolve the modeling issues. 

• Stakeholder Input - Stakeholder input is important for security awareness and creating the 
best plans to secure our critical infrastructure. The framework of the CFATS program is 
sound and was developed with industry’s input. Securing the nation’s critical infrastructure 
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must be done with industry at the table or the unfortunate implementation issues the 
program has experienced to date will be repeated. Many of the implementation delays have 
resulted from the lack of knowledge and experience within ISCD. A simple example 
involves the Top Screen process, which did not work for many companies because in the 
beginning of the program. In this instance, ISCD did not know that the ONG sector stores 
millions of pounds of materials, not thousands. The data field in the web page simply did 
not include enough digits to record actual volumes and required several weeks to correct It 
is worth noting, however, that the level of stakeholder outreach has improved in the past 
year. AFPM encourages DHS to continue this positive trend. 


• Transparency - Informed discussions with stakeholders will lead to less confusion and 
quicken implementation for all parties. In particular, in the National Academies of Science’s 
“Review of the Department of Homeland Security’s Approach to Risk Analysis,” the 
Academy comments multiple times on the significance of stakeholder involvement and 
transparency in effective risk modeling. While the National Academies is commenting on 
risk assessment practices within DHS, the comment is directly applicable to CFATS 
implementation. The National Academies recommendations for transparency and 
stakeholder input would provide benefit not only the risk assessment practices within the 
Infrastructure Security Compliance Division (ISCD), but also provide substantial 
improvement on rule implementation. 


AFPM looks forward to working with you as Congress oversees the progress of CFATS 
implementation. 


Sincerely, 



Charles T. Drevna 
President 
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Mr. Shimkus. The hearing is now adjourned. 

[Whereupon, at 12:53 p.m., the suhcommittee was adjourned.] 
[Material submitted for inclusion in the record follows:] 
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FRED UPTON, MICHIGAN 
CHAIRMAN 


HENRY A. WAXMAN, CALIFORNIA 
RANKING MEMBER 


ONE HUNDRED TWELFTH CONGRESS 

Congress of tfje ®mtelj States 

J?oust ot IXepresentatiticsi 

COMMITTEE ON ENERGY AND COMMERCE 
2125 Rayburn House Office Building 
Washington, DC 20515-6115 

Majority (2021 225-2927 
Minority (202) 225-3641 


Opening Statement of Rep. Henry A. Waxman 
Ranking Member, Committee on Energy and Commerce 
Hearing on “The Chemical Facility Antiterrorism Standards Program - 
A Progress Report” 

Subcommittee on Environment and the Economy 
September 11, 2012 

The 9/1 1 attacks took nearly 3,000 lives. It was the worst attack against the United States 
since Pear! Harbor, and a higher death toll was inflicted on 9/1 1 than even on the date President 
Roosevelt said would “live in infamy.” 

The 9/1 1 attacks were directed at our freedoms, our way of life, and modem civilization 
itself. It was an assault against American leadership in the world and against the ideals that have 
guided us since the founding of the Republic. 

Our resolve from that terrible day was clear: to pursue and defeat those who perpetrated 
this evil and to make sure they can never again threaten the United States of America and those 
who live here. 

Last May, President Obama and brave Navy SEALs eliminated the threat of Osama bin 

Laden. 


Today, as members of the Energy and Commerce Committee, we also have a 
responsibility. We must ask ourselves if we’ve done our part to protect the nation from terrorist 
attack. 


Nearly three years ago, this Subcommittee held a legislative hearing on legislation to 
establish security programs for chemical and drinking water facilities. Our goal was to develop 
comprehensive legislation that would close security gaps, strengthen enforcement authority, 
clarify the criteria for approving or disapproving site security plans, and set enforceable 
deadlines. 

I called that legislation unfinished business from 9/1 1 - critical to homeland security, the 
safety of workers at those facilities, and the public at large. Regrettably, that business remains 
unfinished. 
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This Congress is nearly over and we are no closer to action. 

However, I thank the Chairman for calling this hearing. Conducting oversight of agency 
efforts to implement the existing chemical facility anti-terrorism standards, called CFATS, is 
important, even if the existing standards have too many loopholes. 

As this Congress comes to a close, I hope this hearing will serve to renew our 
commitment to improving the safety of chemical plants. This should not be a partisan issue. We 
need to be able to work together to solve our nation’s problems, as we have many times in the 
past. 

There is little time left to work on CFATS this year, but I hope next year we can return 
and develop legislation that best serves the American people. 


2 
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FRED UPTON, MICHIGAN HENRY A. WAXMAN, CALIFORNiA 

CHAIRMAN RANKING MEMBER 

ONE HUNDRED TWELFTH CONGRESS 

Congress of tfjc ®niteb States 

^ome ot ^Representatitiesi 

COMMITTEE ON ENERGY AND COMMERCE 
2125 Rayburn House Office Building 
Washington, EX 20515-6115 

M&tortty {2(Q}22&-2927 
Minoffty 225-364} 

October 1, 2012 


The Honorable Rand Beere 
Undereecretaiy 

National Protection and Programs Directorate 
Department of Homeland Security 
Washington, D.C. 20528 


Dear Undersecretary Beers: 

Thank you for appearing before the Subcommittee on Environment and the Economy on 
September 1 1, 2012, to testify at the hearing entitled “The Chemical Facility Antiterrorism Standards 
Program - A Progress Report.” 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record remains 
open for 10 business days to permit Members to submit additional questions to witnesses, which are 
attached. The format of your responses to these questions should be as follows: (1) the name of the 
Member whose question you are addressing, (2) toe complete text of toe question you are addressing in 
bold, and then (3) your answer to that question in plain text. 

To facilitate the printing of toe hearing record, please e-mail your responses, in Word or PDF 
format, to Nick.Abraham@mail.house.gov by the close of business on Monday, October 15, 2012. 

Th«ik you again for your time and effort preparing and delivering testimony before the 
Subcommittee. 

Sincerely, 

U ^ 

Uihn Shimkus 

Chairman 

Subcommittee on Environment and toe Economy 


cc: The Honorable Gene Green, Ranking Member, 

Subcommittee on Environment and the Economy 


Attachment 
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Question#: 

1 

Topic: 

V Factor 

Hearing: 

The Chemical Facility Antitcrrorisra Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Despite the statutory requirement that the Chemical Facility Anti -Terrorism 
Standards (CFATS) program be “risk-based,” this Committee recently learned that the 
Department of Homeland Security (DHS) methodology of assessing risk for tiering 
purposes does not vary the vulnerability factor from facility to facility, leaving the 
program more consequence-based than risk-based. 

Has DHS done anything to ensure that each site’s risk profile is evaluated based on that 
site’s distinct vulnerability profile? If so, what specific actions have been undertaken? 

Response: While CFATS facilities were treated as being equally vulnerable during the 
risk assessment process, each facility’s distinct vulnerability profile is taken into 
consideration during the CFATS process. Specifically, when a facility completes its Site 
Security Plan (SSP), or Alternative Security Program (ASP) in lieu of an SSP, the facility 
is asked to identify vulnerability issues related to the security of its chemical(s) of 
interest. Each facility that receives a final tiering letter is informed that it must address 
certain security/vulnerability issues (i.e., theft, release, sabotage) in its SSP or ASP 
related to that facility’s specific chemicals of interest. The Department’s physical, 
chemical, and cyber analysts examine the security measures outlined in the SSP/ASP for 
their potential to mitigate the specific vulnerabilities of the facility. Additionally, during 
Authorization Inspections, CFATS Chemical Security Inspectors review existing and 
planned security measures to ensure that all identified vulnerabilities are being 
adequately addressed. 

Question: When were you first briefed on the “V-Factor” and “vulnerability” being set at 
the same number for all facilities? 

Response: To the best of our knowledge. Under Secretary Beers was originally briefed 
on the “V-factor” and “vulnerability” subject in the summer of 201 1 as part of the review 
of the F 1 factor issue. 

Question: Why weren’t this Committee, the regulated community, and other interested 
parties briefed on the “V-Factor” and its legal and policy implications for the CFATS 
program? 

Response: Throughout the history of the CFATS program, the Department has briefed 
numerous entities, including Congressional staff members, members of the regulated 
community, and other interested parties, on their overall approach to tiering facilities. 
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Question#: 

1 

Topic: 

V Factor 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


During these briefings, it has routinely been noted that the overall tiering methodology is 
risk-based but that potential consequences are the primary driver of the facility’s risk 
profile for purposes of CFATS risk tiering. 
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Question#: 

2 

Topic: 

Personnel Surety 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee; 

ENERGY & COMMERCE (HOUSE) 


Question: DHS first issued a public notice on the Personnel Surety Program (PSP) in 
June 2009, but recently withdrew its proposal from the Office of Management and 
Budget. Now DHS says it will be issuing another 60 day notice for public comment 
before the end of this year and then resubmit a revised final proposal to 0MB for its 
review and approval, perhaps by March 2013. 

Given the time already spent to develop a PSP why is DHS proposing such a protracted 
follow-up process to address issues that have clearly been articulated by the regulated 
community and others? 

Response: In July 2012, the National Protection and Programs Directorate (NPPD) 
withdrew the Chemical Facility Anti-Terrorism Standards (CFATS) Personnel Surety 
Program Information Collection Request (ICR) because our thinking about the CFATS 
Personnel Surety Program had evolved since the ICR was initially submitted to the Office 
of Management and Budget (0MB) in June of201 1. 

In order to implement the information collection aspects of a CFATS Personnel Surety 
Program, DHS must comply with the Paperwork Reduction Act requirements, which 
includes the publication of a Federal Register notice that solicits comments for 60 days 
on proposed information collection requests. 

Question: Will DHS provide options for PSP compliance based on the unique 
circumstances of a covered facility? Please elaborate. 

Response: Yes. The Department has designed CFATS and the CFATS Personnel Surety 
Program to allow each facility in its Site Security Plan or Alternative Security Program to 
account for its unique circumstances when considering how to comply with RBPS-12(iv), 
which requires that final high-risk chemical facilities implement “measures designed to 
identify people with terrorist ties.” The ability to identify individuals with terrorist ties 
requires the use of information held in Federal government databases that are unavailable 
to high-risk chemical facilities. When implemented, the CFATS Personnel Surety 
Program will provide facilities multiple options to comply with this regulatory 
requirement. 

High-risk chemical facilities will have, through their Site Security Plans or Alternative 
Security Programs, the ability to address RBPS 12(iv). High-risk chemical facilities may 
restrict the numbers and types of persons whom they allow to access their restricted areas 
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Question#: 

2 

Topic: 

Personnel Surety 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


and critical assets, thus limiting the number of persons who will need to be vetted for 
terrorist ties. High-risk chemical facilities also have wide latitude in how they define 
their restricted areas and critical assets in their SSPs or ASPs, thus potentially limiting or 
controlling the number of persons who will need to be vetted for terrorist ties. High-risk 
chemical facilities also may choose to escort visitors to restricted areas and critical assets 
in lieu of performing the background checks required by RBPS 12. 

In addition, high-risk chemical facilities will be able to (1) choose one or more options 
for terrorist-ties vetting or vetting verification that the Department has described to date 
or may make available in the future, or (2) propose a different alternative altogether that 
works best for their circumstances. 

Question: Will DHS continue to insist on duplicative reporting of personally identifiable 
information (PII) for those who carry a current and valid Transportation Worker 
Identification Credential (TWIC)? 

Response: The Department supports the sharing and reuse of vetting results among 
different screening programs and is actively considering, and discussing with 
stakeholders, options for effectively leveraging vetting already done on individuals with 
current and valid TWICs. 
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Topic: 

TSDB 

Hearing: 

The Chemical Facility Antiteirorism Standards Program - A Progress Report 

Primary: 

The Honorable John M, Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Recent media reports indicate DHS will accept the use of certain government 
issued ID cards as complying with the PSP requirement for terrorist database screening 
(TSDB), but will continue to require regulated sites to submit personnel information on 
those entering the site to DHS. Why would DHS require this redundant information? 

Response: The Department of Homeland Security (DHS) supports the sharing and reuse 
of vetting results among different screening programs and is actively considering, and 
discussing with stakeholders, options for effectively leveraging vetting already done on 
individuals who hold current and valid credentials. 
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4 

Topic: 

electronic card readers 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Is DHS or the Administration contemplating requiring electronic card readers 
at CFATS facilities as part of its new evolved thinking on the PSP? How does DHS 
square this proposal with Sec. 550 of P.L. 109-295 which explicitly prohibits DHS from 
prescribing specific security measures? 

Response: No, the Department of Homeland Security is not contemplating requiring 
electronic card readers at Chemical Facility Anti-Terrorism Standards (CFATS) facilities 
as part of the CFATS Personnel Surety Program. Facilities will have a variety of options 
for complying with RBPS 12(iv) as part of their Site Security Plans or Alternative 
Security Programs. 
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Hearing: 
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The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Does DHS believe it has an investigative role when it comes to potential hits 
on the TSDB? If so, please cite that legal authority. 

Response: No; however, the Department of Homeland Security will coordinate with 
Federal law enforcement entities to effectively address situations in which known or 
suspected terrorists seek access to high-risk chemical facilities. 
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Topic: 
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Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question; DHS previously announced that it planned to conclude inspections and issue 
Site Security Plan (SSP) authorizations for Tier 1 facilities before the end of the calendar 
year with the hope of beginning compliance activities at Tier 2s shortly thereafter. Does 
DHS have a more specific implementation plan that includes specific milestones for each 
phase of the approval process and for each CFATS Tier Level? Please provide your 
implementation timeline and plan to this Committee. 

Response: Prior to approving a Site Security Plan (SSP), or an Alternative Security 
Program (ASP) in lieu of an SSP, the Infrastructure Security Compliance Division 
(ISCD) must first review and then authorize the SSP or ASP. The review process is 
initiated when ISCD receives the SSP or ASP from a covered facility. ISCD then 
reviews the SSP/ASP to preliminarily determine if it satisfies the applicable Risk Based 
Performance Standards (KBPS) under the Chemical Facility Anti-Terrorism Standards 
regulation, 6 C.F.R. Part 27. This process typically involves discussions between ISCD 
staff and the facility and often requires additional information from the facility and 
revision of the SSP/ASP before ISCD can complete its initial review and issue the facility 
a Letter of Authorization for its SSP/ASP. After issuing a Letter of Authorization, ISCD 
conducts a comprehensive and detailed authorization inspection. The inspection results, 
as well as any further revisions that the facility may make to the SSP/ASP, are reviewed 
to make a final determination as to whether the facility’s SSP/ASP satisfies the applicable 
RBPSs and whether to issue a Letter of Approval. Upon approval, the facility must 
implement the applicable provisions of the SSP/ASP. If ISCD determines that an 
SSP/ASP does not satisfy the applicable KBPS, ISCD may issue a Notice of Deficiency 
and require the facility to resubmit a sufficient SSP/ASP. If the facility fails to do so, 
ISCD may disapprove the SSP/ASP. 

ISCD is scheduled to complete Authorization Inspections by the fourth quarter of Fiscal 
Year (FY) 2013 for Tier 1 facilities and by the second quarter FY14 for Tier 2 facilities. 
Following the Authorization Inspection, facilities are generally granted an additional 45 
days to make any necessary modifications to their SSP/ASPs. ISCD will then review the 
re-submitted SSP/ASP and make a final determination on whether the SSP/ASP warrants 
the issuance of a Letter of Approval. In some cases, the facility may require a Technical 
Consultation and another opportunity to revise its SSP/ASP. Therefore, the schedule to 
issue Letters of Approval to facilities is projected to be the first quarter of FY 2014 for 
Tier 1, and by the third quarter FY 2014 for Tier 2 facilities. 
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The population of Tier 3 and Tier 4 facilities, which pose relatively lower risks than Tier 
1 and Tier 2 facilities, is much larger and DHS is developing options to effectively 
evaluate their SSPs/ASPs. 
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Question: The current CFATS requirements mandate that facilities resubmit a Site 
Vulnerability Assessment (SVA) to DHS every two years. Given DHS’s lack of progress 
in conducting authorization activities and the likelihood that it will not finish approving 
all Tier 1 sites before the end of this year as initially hoped, will DHS consider 
suspending this SVA resubmission requirement until it completes authorizations for these 
tiers? 

Response: The Chemical Facility Anti-Terrorism Standards (CFATS) regulations do not 
mandate that chemical facilities resubmit a Security Vulnerability Assessment (SVA) to 
the Department of Homeland Security (DHS) every two years. 

Under 6 C.F.R. § 27.210(b)(1), CFATS Tier 1 and Tier 2 high-risk facilities must submit 
new Top-Screens to DHS no less than two years, and no more than two years and 60 
calendar days, from the date of DHS’s approval of the respective facilities’ Site Security 
Plans (SSPs). Under the same provision, CFATS Tier 3 and Tier 4 high-risk facilities 
must submit new Top-Screens to DHS no less than three years, and no more than three 
years and 60 calendar days, from the date of DHS’s approval of the respective facilities’ 
SSPs. Under 6 C.F.R. § 27.21 0(b)(2), following the resubmission of a Top-Screen 
pursuant to 6 C.F.R. § 27.2 1 0(b)( 1 ), the Department may require a covered facility to 
complete and submit a new SVA within 90 calendar days of written notification from 
DHS. Thus, under these provisions, a high-risk facility would not be required to resubmit 
an SVA unless DHS’s review of the facility’s resubmitted Top-Screen resulted in a 
determination that an SVA resubraission is warranted. 
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ISCD 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: ISCD has announced that it is currently developing a new, more user-friendly 
SSP tool as part of its CSAT revamp (which includes top screens and SVAs as well). 

Can you detail for us what this redevelopment entails? 

How do you plan to engage industry in developing the SSP tool and reexamining the 
CSAT suite of tools as a whole? 

What is the projected time frame for putting in place a usable tool for regulated facilities? 

Response: Over the past few years, while implementing the Chemical Facility Anti- 
Terrorism Standards (CFATS), the Department of Homeland Security (DHS) has 
received significant feedback on and suggestions for improving its Chemical Security 
Assessment Tool (CSAT) and the various applications that comprise CSAT. 
Concurrently, the Department internally has identified a variety of ways it believes it can 
refine its three primary CSAT applications — the Top-Screen, the Security Vulnerability 
Assessment (SVA), and the Site Security Plan (SSP) — to make the overall CFATS 
process more user-friendly for industry, while simultaneously making it more efficient 
and effective. 

In order to ensure we are incorporating industry feedback to the extent practicable in the 
refinement of the CSAT applications, the Department intends to hold multiple 
roundtables with members of the regulated community in various locations throughout 
the country to solicit additional feedback on the CSAT tools. In addition, the Department 
intends to highlight this effort during its routine outreach and engagement activities and 
use those venues to seek and encourage additional input on potential ways to improve 
CSAT. At the appropriate times during the CSAT improvement effort, the Department 
intends to pilot or ‘beta test’ planned CSAT refinements with members of industry. 
Finally, the public will have an opportunity to comment on revisions to CSAT during the 
PRA process. 


The Department is seeking to release the improved version of the CSAT tool in the third 
quarter of Fiscal Year 2014. 
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PSP 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question; You testified that DHS is currently not able to fully approve or authorize SSPs 
until the PSP has been finalized, and that DHS will only be issuing “conditional” 
authorizations and approvals until the PSP program is in place. If so, does this mean that 
DHS may disapprove an SSP that was previously conditionally approved, once the PSP is 
in place? 

Response: The Infrastructure Security Compliance Division (ISCD) reviews and 
approves facility Site Security Plans (SSPs) based on established Risk Based 
Performance Standards (RBPS). RBPS-12 (Personnel Surety) requires covered facilities 
to implement security measures to identify individuals with terrorist ties. The 
Department of Homeland Security (DHS) is developing a Personnel Surety Program that 
would provide facilities with options to implement such measures. Once finalized, an 
Information Collection Request (ICR) will be submitted to the Office of Management and 
Budget (0MB). DHS cannot fully implement the program until 0MB approves the ICR. 
DHS is currently reserving judgment on the approval of Site Security Plans (SSPs) with 
regard to that aspect of RBPS-12. ISCD will work with covered facilities to ensure that 
their SSPs adequately address all applicable aspects of RBPS-12 as the implementation of 
the Personnel Surety Program progresses. In the meantime, ISCD is moving forward 
with approvals so that facilities can implement the other security measures described in 
their plans. 
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security 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee; 

ENERGY & COMMERCE (HOUSE) 


Question: Congress gave DHS authority to engage with various industry groups on 
development of Alternative Security Program (ASP) templates. DHS has said it continues 
to review existing industry programs, such as ACC Responsible Care® and SOCMA 
ChemStewards®, to identify potential areas of engagement and further discussion. Will 
DHS leverage these and/or other existing programs to help improve chemical security 
and advance CFATS implementation? Please explain your progress in this area. 

Response: Many members of the regulated community and their representative industry 
associations have expressed interest in exploring ways to use the Alternative Security 
Program (ASP) provisions of the Chemical Facility Anti-Terrorism Standards (CFATS) 
regulation to streamline the security plan submission and review process. The 
Infrastructure Security Compliance Division (ISCD) shares this goal and has been 
holding discussions with industry stakeholders in regard to their development of ASP 
templates on behalf of their members. One example has been ISCD’s engagement with 
the American Chemistry Council (ACC) in support of its efforts to develop an ASP 
template for use by interested members of its organization. The ACC developed a 
template which was piloted at facilities in August and October. ACC has indicated that it 
expects its ASP template to be available for wider use later this year. In addition, the 
Department of Homeland Security (DHS) has been in discussions with other industry 
stakeholders and associations about developing templates specific to their members and 
sub-sectors. ASPs submitted by facilities using industry-established models, such as the 
ACC template, will be reviewed under the same standards that ISCD currently reviews 
Site Security Plans, but the use of ASP templates may streamline both the plan 
development and plan review processes. Additionally, DHS continues to review existing 
industry, and sector specific programs, such as ACC Responsible Care® and SOCMA 
ChemStewards®, to identify potential areas of engagement that may contribute to 
CFATS implementation. 


As of October 23, 2012, 426 ASPs have been submitted in lieu of SSPs and 13 ASPs 
have been submitted by Tier 4 facilities in lieu of SVAs. 
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facilities 

Hearing: 

The Chemical Facility Antiterrorism Standards Program ~ A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: While DHS is focusing on the highest risk facilities first, the bulk of the 
facilities in the CFATS program are in the lower risk tiers. At the current pace, it will be 
many years before DHS will even begin approving lower risk facilities. What steps is 
DHS taking to address the tower tiered facilities faster? Has DHS considered using its 
ASP authority for review and approval of lower risk facilities in a way that will 
streamline the implementation process? 

Response: Over the past few months, the Department of Homeland Security (DHS) has 
taken numerous steps to make its procedures more efficient and to increase the pace at 
which facilities’ Site Security Plans (SSPs) are evaluated. These include streamlining the 
SSP review process itself, working on improvements to both the data collection and plan 
review tools, and getting the Department’s field staff involved earlier in the process to 
help identify and work with facilities whose SSPs require additional information before 
they can be fully evaluated. Additionally, the Department is currently exploring various 
approaches to address lower tiered facilities in an even more efficient manner. This 
includes working with industry on Alternative Security Programs (ASPs) and identifying 
ways to make ASPs a more effective option that could be used to a greater extent by 
lower tier high-risk facilities. 



119 


Question#: 

12 

Topic: 
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Hearing: 

The Chemical Facility Antiteirorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee; 

ENERGY & CO.MMERCE (HOUSE) 


Question: Has DHS looked at other examples/models such as the Coast Guard’s 
Alternative Security Program as a best practice to help improve the pace of SSP 
approvals? 

Response: Since 2009, the Department of Homeland Security’s (DHS) National 
Protection and Programs Directorate (NPPD) has met routinely with the U.S. Coast 
Guard (USCG) under the auspices of a Chemical Facility Anti-Terrorism Standards 
(CFATS) / Maritime Transportation Security Act (MTSA) Harmonization Working 
Group to exchange ideas and best practices for potentially improving both CFATS and 
MTSA. As part of this engagement, NPPD and the USCG previously discussed their 
respective approaches to Alternative Security Programs (ASPs) to identify best practices 
and lessons learned regarding the use of ASPs. NPPD is currently exploring ways to 
leverage ASPs to improve the pace of Site Security Plan reviews and is committed to 
reengaging the USCG on its approach to ASPs to see if there are additional best practices 
or lessons learned that could be incorporated by NPPD in the implementation of CFATS. 
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mis-tiering 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Has a facility ever suggested to DHS that it has been placed in a tier lower 
than it should be? If so, when were you or your staff told? 

Response: According to our records, no facility has ever indicated to the Department of 
Homeland Security in writing that it has been tiered lower than it should be. 
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Topic: 

Appendix A 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Is DHS reviewing the Appendix A list of chemicals? If so, when do you plan 
to conclude your review? Do you expect significant amendments to the current list? Will 
this revision slow down or otherwise impact your progress with CFATS implementation? 

Response: The Department of Homeland Security (DHS) is in the process of reviewing 
the Chemical Facility Anti-Terrorism Standards (CFATS) Appendix A list of Chemicals 
of Interest (COIs). Additionally, in support of that effort, the Department’s National 
Protection and Programs Directorate (NPPD) recently entered into a 24-month agreement 
with the Science and Technology Directorate’s Chemical Security Analysis Center 
(CSAC) to conduct applied research on issues related to Appendix A. The CSAC 
recommendations will then be evaluated by DHS and, as previously stated, any potential 
changes to Appendix A will be made through the rulemaking process in coordination 
with 0MB. 


The effort to review Appendix A during fiscal years 2013 and 2014 should not have any 
significant impact on the progress of CFATS implementation during this period. 




122 


Question#: 

15 

Topic: 
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Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question; Have any changes been made to CFATS based upon the recommendations of 
regulated stakeholders? If yes, please detail all of them. 

Has NPPD/IP/ISCD specifically sat down to talk with regulated stakeholders about ways 
to better understand the diverse nature of the chemical industry? What changes, if any, to 
CFATS have been-made based upon those discussions? 

Response: Throughout the development and implementation of the Chemical Facility 
Anti-Terrorism Standards (CFATS), the Department of Homeland Security (DHS) has 
routinely sought the input of the regulated community and other stakeholders. This input 
has been sought and provided in a variety of forums, including requests for public 
comment on the proposed CFATS regulations and Appendix A as well as the Risk-Based 
Performance Standards (KBPS) Guidance. Many of industry’s suggestions in their 
public comments were reflected in the final CFATS regulation, including Appendix A, 
and in the RBPS Guidance. 

In addition, DHS sought input from industry prior to seeking public comments on the 
RBPS Guidance and in the piloting or ‘beta-testing’ of various tools used by the regulated 
community or other CFATS stakeholders. Moreover, the Department has participated in 
thousands of outreach and engagement activities, ranging from major conferences such as 
the annual Chemical Security Summit, to meetings with the Chemical Sector 
Coordinating Council and various industry groups, to one-on-one meetings with facility 
owners and operators. 

This ongoing engagement has resulted in numerous improvements in CFATS 
implementation, including the functionality of the various Chemical Security Assessment 
Tool applications, such as the Top-Screen, the Security Vulnerability Assessment, and 
the Site Security Plan tool. In addition, DHS has sought industry and other stakeholder 
input in the development of the Department’s proposed approach to the CFATS 
Personnel Surety Program. The Department will continue to engage with our industry 
stakeholders as we further develop and make improvements to the CFATS program. 
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funding 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Please provide the amounts appropriated and the amounts obligated for ISCD 
for fiscal years 2007 through 2012. How much of the appropriated money remains 
available to be expended? 

Response: The Infrastructure Security Compliance (ISC) Project has two primary 
initiatives — ^the development and implementation of the Chemical Facility Anti- 
Terrorism Standards (CFATS) program and the development and implementation of the 
Ammonium Nitrate Security Program. Since its inception, the ISC Project has received 
$442.6641 million in appropriated funds and has completed a full accounting of these 
funds. Below is a high-level overview of ISC funding from Fiscal Year (FY) 2007 to FY 
2012. 


\ear ' 



2007* 

22.0 

21.9 


2008 


50.0 

0.0 

2009** 

78.0 

77.7 

0.0 

2010 


98.2 

4.8 

2011 

95.9 

95.7 


2012 

93.3 

88.7 


Total 

442.6 

432.2 

4-8 


Note: Totals may not sum due to rounding. 


* Includes a one-time supplemental appropriation to the Infrastructure Security 
Compliance Division in FY 2007. 

**Includes $5 million for the Ammonium Nitrate Security Program (ANSP). ANSP 
funding has been included in the base ISCD request from 2010 to present. 

^ Between FY 2007 and FY 2011, NPPD tracked salary and benefit funding at a higher 
level than Infrastructure Security Compliance. The figures for those years reflect the 
enacted amount of salary and benefits funding. 


Question: How much of the appropriated money remains available to be expended? 

Response: Of the funds appropriated from FY 2007 to FY 2012, $4,603,655 remains 
available to be obligated as of September 30, 2012. 
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Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question : In the fall of 2011, ISCD leadership began actively engaging the workforce in 
the realignment of the organization by soliciting feedback and inputs and engaging the 
ISCD leadership team, including making efforts to hire permanent branch chiefs. 

What has been done to scope out the job descriptions for these managers? Has the union 
provided any formal or informal input in these Job descriptions? 

Response: Job descriptions for the Deputy Director, Chief of Staff, and Branch Chiefs 
have been completed. The Deputy Director, Chief of Staff, and Branch Chief positions 
are all considered supervisory/leadership positions that are not covered by the current 
Collective Bargaining Agreement. Any additional Job description scoping efforts that 
affect the ISCD inspector workforce will be coordinated with the union leadership. 
Although not required, we have been continually updating AFGE Local 918 on progress 
made on our realignment efforts. 

Question: What is DHS doing to improve management continuity and reverse turnover 
of CFATS leadership, including the ISCD director and personnel in the office of the 
NPPD Undersecretary who work with ISCD? 

Response: The Department of Homeland Security (DHS) continues to recruit career 
oriented personnel who are committed to the success of ICSD’s mission. Going forward, 
it is the goal of ISCD to use “detailed” or “acting” personnel on a very limited and short 
term basis to fill gaps due to vacancies. As part of the realignment, many of these details 
and acting positions will end. ISCD has already begun the process of announcing and 
hiring for many of the positions that are currently held by detailees or personnel operating 
in an acting capacity. NPPD will also continue to use a balanced approach in its hiring 
practices that allows for internal career growth within the organization as w'ell as external 
recruitment practices to bring in qualified personnel and improve the organizational 
culture. 
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Topic: 

Staff 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: The AndersonAVulf Memo expressed concerns that ISCD staff have been 
detailed to NPPD and that calls to return these personnel to ISCD have gone unfulfilled. 
Have these ISCD staff been returned from NPPD to ISCD? If not, why not? 

Response: Leadership in the Infrastructure Security Compliance Division (ISCD), 
National Protection and Programs Directorate (NPPD), and Office of Infrastructure 
Protection (IP) are determining the “right-sizing” of each of these organizations and the 
benefits and shortfalls of both long and short term details. While several ISCD 
employees have been detailed outside the organization, many of these employees are 
receiving experience and training on elements that will benefit ISCD when they return at 
the end of their details. Additionally, ISCD benefits from individuals from within NPPD 
being detailed to fill critical positions within ISCD until permanent staff selections are 
made. ISCD is approaching the final stages of hiring individuals to permanently fill these 
positions. 
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Topic: 

OCS 

Hearing: 

The Chemical Facility Antiterrorisra Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee; 

ENERGY & COMMERCE (HOUSE) 


Question: What is OCS and when was it established? 

Response: The National Protection and Programs Directorate (NPPD) established the 
Office of Compliance and Security (OCS) in October 2010, to independently review and 
evaluate NPPD operations, programs and activities. OCS also investigates alleged 
misconduct by NPPD employees on behalf of NPPD management. 

Question: In 2011, did you task the Office of Compliance and Security (OCS) with a 
fact-finding mission for issues within ISCD? 

Response: Under Secretary Beers tasked OCS to coordinate an inspection of ISCD in 
January 2011, An inspection is an internal evaluation process that enables NPPD 
management to objectively evaluate the strengths and weaknesses of NPPD programs. 
OCS conducted its inspection between April and September 2011, completing its report 
in September 2011 and providing it to NPPD management in October 2011. 

Question: In response to Mr. Latta’s question about vehicles provided to Washington- 
area personnel you referred to an OCS-prepared report of September 2011. Did you 
share a copy of that report with any Congressional Committee? If so when? Please 
provide this Committee with that OCS report, and with any other OCS findings or 
recommendations with regard to CFATS. 

Response: The OCS report was completed in September 201 1 and provided to NPPD 
management in October 2011. Copies of the OCS report were provided to the 
Government Accountability Office in March 2012 and to the Department of Homeland 
Security’s (DHS) Office of the Inspector General (OIG) in May 2012, but it was not 
provided to any Congressional Committee. OCS inspections are internal reviews 
designed to assist management with ensuring that NPPD programs are operating 
efficiently and effectively. Accordingly, inspection reports are provided to appropriate 
NPPD management officials and appropriate Subcomponent leadership. 

Question: Was any OCS review ever used a substitute for any other investigatory effort? 

Response: The OCS program reviews do not function as a substitute for other inquiry 
efforts by DHS or other entities. OCS occasionally undertakes investigations referred or 
declined by the Office of the Inspector General (OIG). In addition, as noted above, OCS 
conducted a program review of CFATS in early 2011. The then-Assistant Secretary for 
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Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Infrastructure Protection (AS/IP) had initially proposed a management review be done by 
contractors, paid for by IP, under the auspices of the OIG. NPPD leadership, including 
the then-AS/IP, concluded that a review by OCS would be more appropriate, effective, 
timely, and cost-efficient. 

Question; Are OCS findings ever made public? 

Response: These reports are not made public, but requests from the public can be 
processed through the Freedom of Information Act or the Privacy Act. All, or portions 
of, reports could be released to the public through such requests, but appropriate 
exemptions would apply to the requested documents. 

Question: Who receives OCS findings and reports? 

Response: OCS inspections are interna! reviews designed to assist management with 
ensuring that NPPD programs are operating efficiently and effectively. Accordingly, 
inspection reports are provided to appropriate NPPD management officials and 
appropriate Subcomponent leadership. OCS reports of investigations that result from 
allegations of misconduct are provided to appropriate management levels of the 
Subcomponent where the subject employee works, as well as to the NPPD Office of 
Employee and Labor Relations and the Office of the General Counsel, if necessary. If an 
inspection uncovers waste, fraud, or abuse, the Inspector General would be notified. 

Question: Did you task OCS to investigate and report on the methodology issues facing 
CFATS? If so, what is the status of that? 

Response: Under Secretary Beers did not task OCS to investigate the Chemical Facility 
Anti-Terrorism Standards (CFATS) program’s methodology. Risk methodology is a 
technically complex issue and is appropriately being reviewed by subject matter experts 
as part of our approach to ensuring that the tiering methodology is sound and facilities are 
properly classified. 
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action items 

Hearing; 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable John M. Shimkus 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: You indicate that DHS has completed more than two-thirds of its self-assigned 
corrective “action” items. What is the status of the remaining items? 

Response: As of November 8, 2012, ISCD has completed 78 of 95 action items. Good 
progress has been made on all of the remaining Action Items and a number of them are 
expected to be completed within the next few weeks. Some action items, however, such 
as Action Item 47 which calls for the revision of the Chemical Security Assessment Tool 
(CSAT), are long term activities and require more time to complete. The revision of the 
CSAT tool is the final milestone on the Action Plan and we project it to be completed in 
the third quarter of Fiscal Year 2014. 
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Topic: 

document 

Hearing; 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable Bill Cassidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: The internal document stated that some employees felt that a certain person 
within the agency was filling subordinate positions based on cronyism. Who was this 
person? Is this individual still employed by the agency and in the same position? Are 
these cronies, if you will, still employed there as well? What about contracts? Were any 
contracts awarded or not awarded because of cronyism? 

The memo indicated there were pay grades for employees that were not justified. Since 
you say that unqualified workers have simply been retrained, have their pay grades been 
adjusted? If not, how do you train someone for a position they were not qualified to fill 
in the first place? 

Response: The internal memorandum cited a perceived lack of transparency with regard 
to personnel actions, including a perception of cronyism and favoritism. However, no 
evidence of cronyism has been identified within the Infrastructure Security Compliance 
Division (ISCD). The Department is not aware of any personnel selections made or 
contracts awarded based upon favoritism or preexisting relationships. 

With regard to the pay grade structure within the division, ISCD is working to ensure that 
all employees are in positions that are appropriate to their grade levels and best suited to 
their skills and expertise. 
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Hearing; 

The Chemical Facility Antiteirorism Standards Program - A Progress Report 

Primarj': 

The Honorable Bill Cassidy 

Committee; 

ENERGY & COMMERCE (HOUSE) 


Question: It has been indicated that there were a number of non-productive workers in 
the program. Yet, your testimony on March 3 1 , 201 1 , indicated that the overall workload 
was being accomplished. Clearly these workers were not needed to accomplish the work, 
or alternatively you were misleading Congress. If it is the former, why have these 
unproductive workers not been released? If it is the latter, how do you justify the 
impression you gave in March of 201 1 suggesting that the workload was being 
accomplished? Also, if these employees were let go, how much money would be saved 
by the agency? 

To go one step further, in the recent report you stated that the agency has taken numerous 
steps to improve the work environment and encourage a system of accountability. What 
has been done about these unproductive workers? 

Response: The internal memorandum observed that, in some instances within 
Infrastructure Security Compliance Division (ISCD) programs, there were discrepancies 
between personnel and their positions. As part of its organizational realignment efforts, 
ISCD is working to ensure that all employees are in positions where they can perform 
most effectively and are best suited to their skills and expertise. Additionally, we have 
been working diligently to ensure that all supervisors in the organization have the 
appropriate training to ensure that there are appropriate chains of accountability. 
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Hearing: 
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The Honorable Bill Cassidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: The memo stated there were instances of workers who abused their gas cards. 
It is my understanding that this is fraud, or even theft of some kind. Why were these 
individuals simply reassigned and not dismissed from the agency? Was there a similar 
move for their supervisors? What accountability has been put in place for situations such 
as this? 

Response: The internal memorandum stated that the absence of effective policies and 
procedures in certain areas could have created an environment where fraud, waste, and 
abuse could have occurred; however, the memorandum did not identify any specific 
instances of fraud, waste, or abuse. 

The Infrastructure Security Compliance Division (ISCD) has instituted several processes 
to ensure accountability to make sure that any misuse would be systematically identified 
and corrective actions taken. For example, ISCD tracks vehicle mileage through both the 
Chemical-Security Management System (CHEMS) and the monthly General Services 
Administration (GSA) invoice. Workers have been instructed to enter their mileage into 
the CHEMS system for every trip that they make in a Government vehicle. ISCD 
compares the GSA mileage to what is recorded in CHEMS. 

ISCD has focused on training its personnel on the proper use of government travel cards 
and purchase cards. ISCD is also providing supervisory training in order to better equip 
its managers to lead their teams and to better foster chains of accountability. 

Additionally, ISCD has outlined, documented, and implemented appropriate procedures 
for using and reporting the use of travel cards. These procedures have been disseminated 
throughout the Division. 
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Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 
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The Honorable Bill Cassidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: The Government Accountability Office stated in their recent report that the 
computer program being used was poorly suited for the CFATS program and it would 
take significant time and money to fix this problem. What has been done on this front? 
How much money has been spent on improvements and how much more will be spent? 

Is there independent analysis of the program, and if so, is it now suitable to meet the 
required function? On a scale of 1-100, where are we on making this program suitable 
for use? 

Response: The Chemical Facility Anti-Terrorism Standards (CFATS) information 
technology (IT) tool suite is suitable now; however, it is not optimal. The Infrastructure 
Security Compliance Division (ISCD) has spent approximately $80 million beginning in 
the fourth quarter of fiscal year (FY) 2006 through FY 2012 (Project Life Cycle) on its IT 
investments. ISCD estimates that it will cost approximately $6 million to make 
enhancements to its IT systems in FY 2013. These funds are included in the FY 2013 
request. The planned improvements were identified internally by ISCD through 
integrated project teams and other requirement elicitation techniques. ISCD anticipates 
that improvements to the CFATS tools suite will be released in the third quarter of 
FY14. 

ISCD will continually evaluate its IT capabilities and identify areas of improvement, 
making enhancements and modifications as necessary. 
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The Chemical Facility Antiterrorism Standards Program - A Progress Report 
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The Honorable Bill Cassidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Initially, union contracts were blamed for struggles to accomplish even minor 
changes to the program. Has the union renegotiated and accepted changes in the contract 
governing how work rules can be changed and implemented? If not, why are we to 
believe that great strides are being made when the internal report indicated that contracts 
would limit ability to makes these changes? What large scale changes have been made? 
Specifically list and share what processes took place to approve these changes. 

Response: The internal memorandum described the potential complexities the presence 
of a union could have presented during the relatively early stages of the program’s 
development. That being said, we believe that the American Federation of Government 
Employees, Local 918 (AFGE Local 918) has been supportive of the Chemical Facility 
Anti-Terrorism Standards (CFATS) program. The union shares with NPPD an interest in 
moving the program forward and has provided valuable perspectives in the 
implementation process. AFGE Local 91 8 and NPPD enjoy a productive relationship 
that has grown through close coordination, communication, and regular meetings. The 
union has expedited its review of key policies and procedures that have enabled the 
Infrastructure Security Compliance Division to turn the comer in implementing the 
CFATS program. We will continue to build upon this working relationship to ensure that 
AFGE Local 91 8 continues to be a key stakeholder in helping to move the CFATS 
program forward. 
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Question#: 

26 

Topic: 

investigation 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable Bill Cassidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: During the original investigation, it was found that a number of employees had 
a law enforcement mindset, as opposed to a regulator mindset envisioned within the 
original statute. Have these individuals been given the pistols, badges, and uniforms they 
requested; have they been replaced by others with a proper mindset; or have they simply 
not been replaced? 

Response: The Infrastructure Security Compliance Division (ISCD) staff brings a wealth 
of experience from careers in industry, law enforcement, military service, and a host of 
other disciplines. This breadth of experience has contributed to the progress ISCD has 
made as a regulatory compliance organization. During the initial stages of the Chemical 
Facility Anti-Terrorism Standards (CFATS) program, a number of individuals with law 
enforcement backgrounds were detailed from the Federal Protective Service (FPS) to 
help establish the initial corps of CFATS inspectors. As the CFATS program matured, 
the roles and responsibilities of the inspectors were clarified. 

When the FPS details expired, a number of the original detailees applied for permanent 
positions with ISCD with the knowledge that CFATS inspectors are not law enforcement 
officers. The remaining FPS personnel who were detailed to ISCD returned to FPS. 

ISCD has also worked to ensure that the inspectors who were subsequently hired also 
understand that their positions do not involve acting as law enforcement officers. 

iSCD inspectors have been issued Department of Homeland Security (DHS) credentials 
and often wear standardized rough duty outerwear to accommodate field activity and 
more readily identify the inspectors to the regulated community and other Federal, state, 
and local agencies. At no time, however, has the Department provided firearms or 
badges to inspectors under CFATS. 
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Question#: 

27 

Topic: 

feedback 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable Bill Cassidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: Is there a method in place for your industry partners to give feedback on 
inspectors without fear of reprisal? 

Response: Extensive outreach activities provide numerous opportunities for industry to 
give feedback on inspectors and other aspects of the program. The National Protection 
and Programs Directorate (NPPD) and Infrastructure Security Compliance Division 
(ISCD) management and staff have presented at hundreds of security and chemical 
industry conferences and participated in a variety of other meetings. As part of this 
outreach program, NPPD and ISCD have regularly communicated with impacted sectors 
through numerous trade associations and through the Sector Coordinating Councils — 
including the Chemical, Oil and Natural Gas, and Food and Agriculture Sectors. 
Additionally, this past summer marked the sixth iteration of the Chemical Sector Security 
Summit, an annual event co-sponsored by DHS and the Chemical Sector Coordinating 
Council (SCC). The Summit is essential to the Department’s continuous outreach with 
the chemical industry and provides another opportunity for dialogue with our 
infrastructure stakeholders. 

It is our hope that by building these relationships industry stakeholders do not feel 
inhibited or fear reprisal in providing candid feedback on the performance of CFATS 
inspectors or other members of ISCD staff. 




136 


Question#: 

28 

Topic: 

internal report 

Hearing: 

The Chemical Facility Antiterrorism Standards Program ~ A Progress Report 

Primary: 

The Honorable Bill Cassidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: The internal report stated employees demanded overtime to answer their 
phones on official business during the lunch hour. Do they receive overtime now? If not, 
do they take official calls? Is this subject to union negotiation and agreement to the work 
rules? 

Response: There are no employees within the Infrastructure Security Compliance 
Division (ISCD) demanding overtime to answer phone calls during allotted lunch times. 
The Division’s employees are professionals who recognize that securing America’s high- 
risk chemical facilities cannot always be accomplished on a “9 to 5” work schedule. In 
light of this reality, ISCD continues to work closely with National Protection and 
Programs Directorate (NPPD) and Office of Infrastructure Protection (IP) human capital 
staffs to ensure all matters related to approved premium pay and overtime work are 
implemented in accordance with 5 U.S.C. Chapter 55, Subchapter 5 and applicable Office 
of Personnel Management guidance. 
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Question#: 

29 

Topic: 

CFATS program 

Hearing: 

The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: 

The Honorable Bill C^sidy 

Committee: 

ENERGY & COMMERCE (HOUSE) 


Question: In your testimony on March 31, 201 1, you gave no indication of problems in 
the program, yet you were simultaneously requesting that an informal internal 
investigation be carried out. How can we trust that you are currently being honest as to 
how the CFATS program is progressing? 

Response: The National Protection and Programs Directorate’s (NPPD) Office of 
Compliance and Security (OCS) completed its report in October 2011. At the time of the 
hearing, I did not have reason to believe that any of concerns that prompted the review 
would prevent the Chemical Facility Anti-Terrorism Standards (CFATS) program from 
making progress. The Infrastructure Security Compliance Division’s (ISCD) proactive 
approach to identifying, mitigating, and resolving programmatic and management issues 
has led to substantial progress. We remain committed to working with you and the 
Committee to keep you informed about the progress of the program, and as part of that 
commitment, we will also keep you apprised of significant issues that arise. 

Question: On another note, you claim that since January of 2012, two sites have been 
approved by the CFATS standards. How can this be true given that the personnel surety 
issue has not been resolved? 

Response: For the Site Security Plans (SSPs) that ISCD has approved thus far, the 
Letters of Approval specifically state that the Department of Homeland Security (DHS) 
has reserved judgment with respect to Risk Based Performance Standard (RBPS) 12: 
Personnel Surety. The Department will continue to work with the facilities to ensure that 
their SSPs fully address all applicable aspects of RBPS-12, and will assist the facilities in 
understanding the Personnel Surety Program when it is finalized. 
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Question#: 

30 

Topic: 

personnel surety program 

Hearing: 

The Chemical Facility Antiteirorism Standards Program - A Progress Report 

Primary: 

The Honorable Bill Cassidy 

Committee; 

ENERGY & COMMERCE (HOUSE) 


Question: NPPD’s approach to the personnel surety program seems more in line with a 
police force culture than that of a regulatory program. For example, NPPD/ISCD has 
proposed that regulated entities submit detailed personnel data to ISCD, but has not 
proposed helping those same entities by informing them whether personnel with chemical 
facility access are or are not on the terrorist watch list. By contrast TSA, by issuing a 
TWIC card, reassures the Coast Guard’s regulated chemical facilities that a person is not 
on the watch list. Why do two agencies within the same Department take such different 
approaches? How is a chemical facility to assure its workers, neighbors, insurers, and 
investors that it meets minimum standards for anti-terrorism security if it is not permitted 
to know whether its employees are or are not on the terrorist watch list? 

Response: The design of both the Chemical Facility Anti-Terrorism Standards (CFATS) 
Personnel Surety Program and the Transportation Worker Identification Credential 
(TWIC) program include a recurrent check for ties to terrorism. The Department of 
Homeland Security follows Government-wide procedures already in place regarding 
notification of terrorist watchlist matches as a result of security checks we conduct. 

Under the CFATS Personnel Surety Program, as with all other Department programs 
such as TWIC, the Department will continue to coordinate our efforts and responses with 
appropriate law enforcement and the intelligence community on a case-by-case basis. 
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AccountBbHIty ‘ Integrity * Reliability 


United States Government Accountability Office 
Washington, DC 20548 


October 15, 2012 

The Honorable John Shimkus 
Chairman 

Subcommittee on Environment and the Economy 
Committee on Energy and Commerce 
House of Representatives 

Subject: Critical Infrastructure Protection: GAO Response to Posthearing Questions 
for the Record 

Dear Mr. Chairman: 

On September 1 1 , 201 2, we testified before your committee on the Department of 
Homeland Security’s (DHS) actions underway to better manage its chemical security 
program.' The Chairman of the committee requested that we provide additional 
comments to a number of post hearing questions. The questions and our answers 
are provided in the Enclosure. The responses are based on work associated with 
previously issued GAO products. If you have any questions about this letter or need 
additional information, please contact me at (202) 512-3404 or berrickc@gao.gov. 

Sincerely yours. 



Cathleen A. Berrick 
Managing Director 
Homeland Security and Justice 

Enclosure 


' GAO. Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its Chemical Security Program, 
but It Is Too Early to Assess Results, GAO-12-567T (Washington, D.C.: Sept. 11, 2012). 
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Enclosure 

The Honorable John Shimkus 


1. We are told that DHS has historically scored towards the bottom of all 
departments and agencies surveyed by 0PM on employee morale. 

Given that the former ISCD Director characterized employee morale as 
“a significant issue,” do these survey results for NPPD specifically offer 
any insight into this issue? 

Data on the National Protection and Programs Directorate's (NPPD) scores 
provide insights into morale problems facing NPPD overall. Specifically, data 
from the survey showed that, in 201 1 , NPPD scored slightly lower than the 
Department of Homeland Security (DHS) average in three of four 
categories — leadership and knowledge management; talent management, 
and job satisfaction— and slightly higher than the DHS average for the fourth 
category — resuits-oriented performance culture. NPPD also scored lower in 
all four categories relative to government-wide averages for those categories. 
Table 1 compares 0PM survey results for NPPD, DHS, and Government- 
wide for the four categories. 

Table 1: Percent of NPPD Employees Who Responded Positively to 2011 Federal Employee 
Viewpoint Survey Questions about Leadership and Knowledge Management, Results-Oriented 
Performance Culture, Talent Management, and Job Satisfaction Compared to Responses by 
Employees DHS and Government-wide 


Organization 

Leadership and 
Knowledge 
Management 
Index* 

Results-Oriented 
Perfonnance 
Culture Index*’ 

Talent 

Management 

Index'" 

Job Satisfaction 
Index‘d 

NPPD 

51% 

51% 

50% 

62% 

DHS 

55% 

48% 

53% 

64% 

Government-Wide 

62% 

54% 

60% 

68% 


Source: OPM's 2011 Federid Emi^oyee Viewpoint Survey. 


®The Leadership and Knowledge Management Index shows the percent of employees who responded 
positively to survey questions about the extent to which employees hold leadership in high regard, both 
overall and on specific facets of leadership, 

’’The Results-Oriented Performance Culture Index shows the percent of employees who responded 
positively to survey questions about the extent to which employees believe their organizational culture 
promotes improvements in processes, products and services, and organization outcomes. 

‘^The Talent Management Index shows the percent of employees who responded positively to survey 
questions about the extent to which employees within the organization have the talent necessary to 
achieve organization goals. 

^The Job Satisfaction Index shows the percent of employees who responded positively to survey 
questions about the extent to which employees are satisfied with their jobs. 


DHS has taken steps to identify where it has the most significant employee 
satisfaction problems and developed plans to address those problems, but 
has not yet improved DHS employee satisfaction survey results. We have 
previously reported that concerns about pay and a lack of trust in leadership 
can lead to morale problems.^ We stated that, given the critical nature of 


^ GAO, Department of Homeland Security: Preliminary Observations on DHS's Efforts to Improve Employee 
Morale, GAO-12-509T (Washington, D.C,: Mar. 22, 2012). 
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DHS’s mission to protect the security and economy of the United States, it is 
important that DHS employees are satisfied with their jobs so that DHS can 
attract and retain the talent required to complete its work. We plan to issue a 
report on the final results of our work related to employee morale issues at 
DHS later this month. 

2. Has leadership turnover in the CFATS program contributed to many of 
the problems the program has encountered? What can DHS do to 
reduce this problem? 

The numerous changes in Chemical Facility Anti-Terrorism Standards 
(CFATS) program leadership, and the fact that many of the Infrastructure 
Security Compliance Division (ISCD) leaders have served in “acting” roles 
and have since left the position, could have impacted ISCD’s ability to 
implement and transform the CFATS program. For example, a senior NPPD 
official told us that changes in ISCD management have made it difficult to 
have ongoing budget discussions with ISCD. However, we have not 
specifically reviewed the extent to which turnover in the program has 
contributed to existing problems. When a program is attempting to transform 
itself, however, leadership is critical. Our work on organizational 
transformation found that top organizational leadership must set the direction, 
pace, and tone, and provide a clear, consistent rationale that brings everyone 
together behind a single mission. Appointing Mr. Wulf as the new director 
should benefit the program because he knows the challenges the program 
has experienced and has been involved in managing some of the more recent 
efforts to address those challenges. 

3. It appears that many of the dates for completing items in the action plan 
have slipped by as many as 90 days, some because the work required to 
complete items was not fully understood, others because the action had 
not yet been approved by either NPPD or IP. What do these date 
slippages say about management leadership? 

ISCD, the Office of Infrastructure Protection (IP), and NPPD appear to be 
making a concerted effort to address and resolve the human capital, mission, 
and administrative challenges identified in the November 201 1 internal 
memorandum, but it’s too early to tell what the ultimate impact of these efforts 
will be on the CFATS program. While the efforts outlined in the action plan 
are a good beginning to addressing identified issues, it is important to note 
that successfully implementing the action plan won’t in itself ensure success 
for the program; rather, sustained commitment to and leadership by NPPD, 

IP, and ISCD, as well as continual monitoring and adjustment, as needed, will 
be critical. Further, where progress or performance deviates from expected 
results, it will be important for NPPD, IP, and ISCD managers to identify 
causes and take corrective actions, as needed. 

4. One of the most important aspects of CFATS implementation centers on 
developing viable partnerships between government and facilities 
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covered by the rule. Where does DHS currently stand with regard to 
building and forming partnerships with the CFATS community? 

A senior ISCD official told us that ISCD has recently reinvigorated its outreach 
to industry as part of the action plan that accompanied the internal 
memorandum. This could be important to the success of the program. We 
intend to examine ISCD’s process for gathering and reviewing facility 
information, as well as ISCD’s efforts to work with industry, during the second 
phase of our work on mission-related issues. We expect to report on the 
results of this work in the spring of 2013. 

5. Many of the issues discussed in the action plan cut across IP 

components. These issues include the management of Administratively 
Uncontrollable Overtime, the location of field offices, the use of vehicles 
and purchase cards, and the management of travel among IP field staff. 

a. To what extent is NPPD looking to consolidate the management 
of these issues to avoid inconsistencies? 

NPPD is in the process of consolidating management for some 
administrative activities at the NPPD-level. For example, NPPD 
officials told us that they were developing a guidance document that is 
intended to make the use of administratively uncontrollable overtime 
more consistent throughout NPPD. Also, NPPD is in the process of 
finalizing a NPPD-wide fleet management standard operating 
procedure that is intended to standardize vehicle use across NPPD. 
Furthermore, NPPD officials stated that NPPD is developing a field 
structure that is to consider the needs of all NPPD components, 
including ISCD and the Protective Security Coordination Division. 
However, these efforts are in various stages of implementation, and it's 
too early to tell whether they will result in improved management of 
these administrative functions or avoid inconsistencies. 

b. What challenges does NPPD face developing a consistent way to 
manage these functions across components and what can NPPD 
do to overcome any challenges? 

NPPD faces challenges overseeing a diverse group of components, 
including IP, the Office of Cybersecurity and Communications, and the 
Federal Protective Service. Furthermore, some organizations within 
these components have diverse missions and responsibilities. For 
example, IP houses ISCD which has regulatory responsibility with 
regard to the security of high-risk chemical facilities and also houses 
the Protective Security Coordination Division, which manages DHS’s 
voluntary critical infrastructure protection programs. Efforts to 
consolidate some administrative activities across components could 
help NPPD better manage these activities but it remains to be seen the 
extent to which NPPD is successful in doing so. It will be important for 
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NPPD to monitor the results of its consolidation initiatives once 
implemented to help ensure intended outcomes are achieved. 

c. Based on your work, does it appear that NPPD and IP are taking 
adequate steps to provide the support ISCD needs to address 
management and administrative issues? 

NPPD, IP, and ISCD officials are meeting regularly to discuss the 
challenges highlighted in the ISCD internal memorandum and are 
working together to develop solutions. In addition, according to 
officials, IP plans to co-locate one of its staff with ISCD to facilitate 
hiring of ISCD staff; accelerate the hiring process; and help keep ISCD 
hiring on track. 

6, You have recommended that DHS explore opportunities to develop 
performance measures associated with the action plan, where practical. 

a. Why are performance measures important? 

By developing performance measures, managers in departments and 
agencies and their components, like ISCD, can be better positioned to 
identify any gaps in their efforts to enhance performance and have the 
tools available to measure and monitor perfonnance in the future. 
Performance measures also provide a framework for providing 
continuity of operations when new managers or staff are hired, 
managers move from position to position, or as the program 
changes— a key factor in some of the challenges facing ISCD. 
Furthermore, having performance measures better equips 
organizations, like ISCD, to inform stakeholders of their progress as 
their organization moves toward addressing problems or issues, and 
managing for results. Moreover, measuring results associated with 
particular action items would be consistent with Standards for Internal 
Control in the Federal Government, which calls for the establishment 
and review of performance measures and indicators to monitor 
activities and compare actual performance with planned or expected 
results throughout the organization and analyze significant differences. 

b. What is the value of developing performance measures now, as 
opposed to after the action plan is complete, as suggested by 
DHS? 

Having performance measures in place as the action plan is being 
implemented would help provide DHS with information on how well the 
processes it is putting in place as part of the action plan are working, 
and whether corrective actions or adjustments are needed to keep the 
organization on track with achieving its goals. As such, it would serve 
DHS well to develop performance measures as elements of the action 
plan are completed, rather than waiting until the entire action plan is 
complete, which may be some time away. 
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. What types of things do you think that DHS should measure? 

ISCD performance measures would allow iSCD to link an action from 
the action plan to longer term programmatic improvements. For 
example, one action item calls for ISCD to identify and develop an 
appropriate IT platform in support of inspection activities. As ISCD 
begins to develop the platform, it could build in ways to measure its 
progress developing the platform as well as the platform’s functionality 
in meeting user’s needs. Another action item calls for ISCD to “revise 
the Chemical Security Assessment Tool (CSAT) to create a more 
efficient and effective tool for both industry and ISCD based on 
industry engagement.” As the revision to the CSAT begins, ISCD 
could develop measures to compare the old tool to the new tool 
including actions it has taken to make the tool more efficient and 
effective. For example, ISCD could develop measures to determine if 
the length of time to complete each part of the tool is reduced from 
both the perspective of the facility (when completing the tool) and ISCD 
(when reviewing the information the facility provides via the tool). 



